renderer: check shader continuation fits

Fix found thanks to american fuzzy lop.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

1 files changed, 7 insertions, 0 deletions

diff --git a/src/vrend_renderer.c b/src/vrend_renderer.c
index 2e380a9..05a2ed7 100644
--- a/src/vrend_renderer.c
+++ b/src/vrend_renderer.c
@@ -2180,6 +2180,13 @@ int vrend_create_shader(struct vrend_context *ctx,
          vrend_renderer_object_destroy(ctx, handle);
          return EINVAL;
       }
+      if ((pkt_length * 4 + sel->buf_offset) > sel->buf_len) {
+         fprintf(stderr, "Got too large shader continuation %d vs %d\n",
+                 pkt_length * 4 + sel->buf_offset, sel->buf_len);
+         vrend_renderer_object_destroy(ctx, handle);
+         return EINVAL;
+      }
+
       memcpy(sel->tmp_buf + sel->buf_offset, shd_text, pkt_length * 4);
 
       sel->buf_offset += pkt_length * 4;