From 839c510a7505a5ee8931c24aee5d15de031d641a Mon Sep 17 00:00:00 2001
From: baldurk <baldurk@baldurk.org>
Date: Fri, 20 Mar 2020 10:12:53 +0000
Subject: [PATCH] Fix overflow when clamping length of buffer data fetch

---
 renderdoc/driver/d3d11/d3d11_debug.cpp |  2 +-
 renderdoc/driver/d3d12/d3d12_debug.cpp |  2 +-
 renderdoc/driver/gl/gl_replay.cpp      | 26 +++++++++++---------------
 renderdoc/driver/vulkan/vk_debug.cpp   |  2 +-
 4 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/renderdoc/driver/d3d11/d3d11_debug.cpp b/renderdoc/driver/d3d11/d3d11_debug.cpp
index b0abc40b3..762db6058 100644
--- a/renderdoc/driver/d3d11/d3d11_debug.cpp
+++ b/renderdoc/driver/d3d11/d3d11_debug.cpp
@@ -351,7 +351,7 @@ void D3D11DebugManager::GetBufferData(ID3D11Buffer *buffer, uint64_t offset, uin
     return;
   }
 
-  if(len == 0)
+  if(len == 0 || len > desc.ByteWidth)
   {
     len = desc.ByteWidth - offs;
   }
diff --git a/renderdoc/driver/d3d12/d3d12_debug.cpp b/renderdoc/driver/d3d12/d3d12_debug.cpp
index a05ec903c..b6b499af1 100644
--- a/renderdoc/driver/d3d12/d3d12_debug.cpp
+++ b/renderdoc/driver/d3d12/d3d12_debug.cpp
@@ -819,7 +819,7 @@ void D3D12DebugManager::GetBufferData(ID3D12Resource *buffer, uint64_t offset, u
     return;
   }
 
-  if(length == 0)
+  if(length == 0 || length > desc.Width)
   {
     length = desc.Width - offset;
   }
diff --git a/renderdoc/driver/gl/gl_replay.cpp b/renderdoc/driver/gl/gl_replay.cpp
index aef349f90..be608734c 100644
--- a/renderdoc/driver/gl/gl_replay.cpp
+++ b/renderdoc/driver/gl/gl_replay.cpp
@@ -323,27 +323,23 @@ void GLReplay::GetBufferData(ResourceId buff, uint64_t offset, uint64_t len, byt
 
   uint64_t bufsize = buf.size;
 
-  if(len > 0 && offset + len > bufsize)
+  if(offset >= bufsize)
   {
-    RDCWARN("Attempting to read off the end of the buffer (%llu %llu). Will be clamped (%llu)",
-            offset, len, bufsize);
-
-    if(offset < bufsize)
-      len = ~0ULL;    // min below will clamp to max size
-    else
-      return;    // offset past buffer size, return empty array
+    // can't read past the end of the buffer, return empty
+    return;
   }
-  else if(len == 0)
+
+  if(len == 0 || len > bufsize)
   {
     len = bufsize;
   }
 
-  // need to ensure len+offset doesn't overrun buffer or the glGetBufferSubData call
-  // will fail.
-  len = RDCMIN(len, bufsize - offset);
-
-  if(len == 0)
-    return;
+  if(offset + len > bufsize)
+  {
+    RDCWARN("Attempting to read off the end of the buffer (%llu %llu). Will be clamped (%llu)",
+            offset, len, bufsize);
+    len = RDCMIN(len, bufsize - offset);
+  }
 
   ret.resize((size_t)len);
 
diff --git a/renderdoc/driver/vulkan/vk_debug.cpp b/renderdoc/driver/vulkan/vk_debug.cpp
index a86854bee..cdafe6fac 100644
--- a/renderdoc/driver/vulkan/vk_debug.cpp
+++ b/renderdoc/driver/vulkan/vk_debug.cpp
@@ -1573,7 +1573,7 @@ void VulkanDebugManager::GetBufferData(ResourceId buff, uint64_t offset, uint64_
     return;
   }
 
-  if(len == 0)
+  if(len == 0 || len > bufsize)
   {
     len = bufsize - offset;
   }