From 838c9be2bc21df9ab804428d53bf61fa906be4b4 Mon Sep 17 00:00:00 2001
From: Shrek Shao <shrekshao@google.com>
Date: Thu, 02 Apr 2026 15:41:06 -0700
Subject: [PATCH] D3D11: Fix overflow in compressed 3D texture deferred-init

The ANGLE D3D11 backend computed the zero-fill buffer size for
block-compressed 3D textures using an unchecked
32-bit multiplication that did not account for block height.
This produced a value four times larger than the actual
compressed image size and could overflow for sufficiently large
textures.

This fix:
1. Uses InternalFormat::computeCompressedImageSize to correctly
calculate the required buffer size for compressed textures,
taking block dimensions into account.
2. Employs angle::CheckedNumeric for uncompressed texture size
calculations to prevent potential integer overflows.
3. Adds a regression test DeferredInit3DOverflow
that uses large texture dimensions (2048x2048x320) to verify
there is no ASAN error.

Bug: b/497896137
Change-Id: I76f0fb008af34e8ac78870318e608d16ed4ddd93
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7728091
Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org>
Commit-Queue: Shahbaz Youssefi <syoussefi@chromium.org>
Auto-Submit: Shrek Shao <shrekshao@google.com>
---

diff --git a/src/libANGLE/renderer/d3d/TextureD3D.cpp b/src/libANGLE/renderer/d3d/TextureD3D.cpp
index 6d36548..be59fad 100644
--- a/src/libANGLE/renderer/d3d/TextureD3D.cpp
+++ b/src/libANGLE/renderer/d3d/TextureD3D.cpp
@@ -947,9 +947,23 @@
     const auto &formatInfo = gl::GetSizedInternalFormatInfo(image->getInternalFormat());
 
     GLuint imageBytes = 0;
-    ANGLE_CHECK_GL_MATH(contextD3D, formatInfo.computeRowPitch(formatInfo.type, image->getWidth(),
-                                                               1, 0, &imageBytes));
-    imageBytes *= image->getHeight() * image->getDepth();
+    if (formatInfo.compressed)
+    {
+        ANGLE_CHECK_GL_MATH(
+            contextD3D, formatInfo.computeCompressedImageSize(
+                            gl::Extents(image->getWidth(), image->getHeight(), image->getDepth()),
+                            &imageBytes));
+    }
+    else
+    {
+        ANGLE_CHECK_GL_MATH(contextD3D, formatInfo.computeRowPitch(
+                                            formatInfo.type, image->getWidth(), 1, 0, &imageBytes));
+
+        angle::CheckedNumeric<GLuint> checkedImageBytes(imageBytes);
+        checkedImageBytes *= image->getHeight();
+        checkedImageBytes *= image->getDepth();
+        ANGLE_CHECK_GL_MATH(contextD3D, checkedImageBytes.AssignIfValid(&imageBytes));
+    }
 
     gl::PixelUnpackState zeroDataUnpackState;
     zeroDataUnpackState.alignment = 1;
diff --git a/src/tests/gl_tests/BPTCCompressedTextureTest.cpp b/src/tests/gl_tests/BPTCCompressedTextureTest.cpp
index dbac858..7368a85 100644
--- a/src/tests/gl_tests/BPTCCompressedTextureTest.cpp
+++ b/src/tests/gl_tests/BPTCCompressedTextureTest.cpp
@@ -452,3 +452,55 @@
 
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(BPTCCompressedTextureTestES3);
 ANGLE_INSTANTIATE_TEST_ES3(BPTCCompressedTextureTestES3);
+
+class BPTCCompressedTextureTestES3WebGL : public BPTCCompressedTextureTestES3
+{
+  protected:
+    BPTCCompressedTextureTestES3WebGL()
+    {
+        setWebGLCompatibilityEnabled(true);
+        setRobustResourceInit(true);
+    }
+};
+
+// Test that initializing a large 3D BPTC texture doesn't overflow the size calculation.
+// This is a regression test for a bug where the size was computed as (width/4 * 16) * height *
+// depth instead of (width/4 * 16) * (height/4) * depth.
+TEST_P(BPTCCompressedTextureTestES3WebGL, DeferredInit3DOverflow)
+{
+    ANGLE_SKIP_TEST_IF(!IsGLExtensionEnabled("GL_EXT_texture_compression_bptc"));
+
+    // The overflow happens in the D3D11 backend.
+    // The dimensions 2048x2048x320 were reported to trigger it.
+    // 2048/4 * 16 = 8192 (row pitch)
+    // 8192 * 2048 * 320 = 5,368,709,120, which wraps to 1,073,741,824 in 32-bit GLuint.
+    // The correct size is 1,342,177,280 (1.25 GB).
+    // Since the wrapped buggy size is smaller than the correct size, it triggers an OOB read.
+    // 1.25 GB is large enough that it might trigger GL_OUT_OF_MEMORY on some systems.
+
+    GLTexture tex;
+    glBindTexture(GL_TEXTURE_3D, tex);
+    {
+        ScopedIgnorePlatformMessages ignore;
+        glTexStorage3D(GL_TEXTURE_3D, 1, GL_COMPRESSED_RGBA_BPTC_UNORM_EXT, 2048, 2048, 320);
+    }
+    GLenum err = glGetError();
+    // Allow GL_OUT_OF_MEMORY as the texture is large.
+    ASSERT_TRUE(err == GL_NO_ERROR || err == GL_OUT_OF_MEMORY);
+
+    if (err != GL_OUT_OF_MEMORY)
+    {
+        // Trigger deferred initialization by updating a small sub-region.
+        std::vector<GLubyte> data(16, 0);
+        glCompressedTexSubImage3D(GL_TEXTURE_3D, 0, 0, 0, 0, 4, 4, 1,
+                                  GL_COMPRESSED_RGBA_BPTC_UNORM_EXT, 16, data.data());
+        err = glGetError();
+        EXPECT_TRUE(err == GL_NO_ERROR || err == GL_OUT_OF_MEMORY);
+    }
+}
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(BPTCCompressedTextureTestES3WebGL);
+// The overflow happens in the "slow path" of initializeContents, which is only called if
+// robust resource initialization is enabled. Since it is always enabled in WebGL, we
+// enable it here to reproduce the bug.
+ANGLE_INSTANTIATE_TEST(BPTCCompressedTextureTestES3WebGL, ES3_D3D11());

diff --git a/src/tests/gl_tests/BPTCCompressedTextureTest.cpp b/src/tests/gl_tests/BPTCCompressedTextureTest.cpp
index dbac858..7368a85 100644
--- a/src/tests/gl_tests/BPTCCompressedTextureTest.cpp
+++ b/src/tests/gl_tests/BPTCCompressedTextureTest.cpp
@@ -452,3 +452,55 @@
 
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(BPTCCompressedTextureTestES3);
 ANGLE_INSTANTIATE_TEST_ES3(BPTCCompressedTextureTestES3);
+
+class BPTCCompressedTextureTestES3WebGL : public BPTCCompressedTextureTestES3
+{
+  protected:
+    BPTCCompressedTextureTestES3WebGL()
+    {
+        setWebGLCompatibilityEnabled(true);
+        setRobustResourceInit(true);
+    }
+};
+
+// Test that initializing a large 3D BPTC texture doesn't overflow the size calculation.
+// This is a regression test for a bug where the size was computed as (width/4 * 16) * height *
+// depth instead of (width/4 * 16) * (height/4) * depth.
+TEST_P(BPTCCompressedTextureTestES3WebGL, DeferredInit3DOverflow)
+{
+    ANGLE_SKIP_TEST_IF(!IsGLExtensionEnabled("GL_EXT_texture_compression_bptc"));
+
+    // The overflow happens in the D3D11 backend.
+    // The dimensions 2048x2048x320 were reported to trigger it.
+    // 2048/4 * 16 = 8192 (row pitch)
+    // 8192 * 2048 * 320 = 5,368,709,120, which wraps to 1,073,741,824 in 32-bit GLuint.
+    // The correct size is 1,342,177,280 (1.25 GB).
+    // Since the wrapped buggy size is smaller than the correct size, it triggers an OOB read.
+    // 1.25 GB is large enough that it might trigger GL_OUT_OF_MEMORY on some systems.
+
+    GLTexture tex;
+    glBindTexture(GL_TEXTURE_3D, tex);
+    {
+        ScopedIgnorePlatformMessages ignore;
+        glTexStorage3D(GL_TEXTURE_3D, 1, GL_COMPRESSED_RGBA_BPTC_UNORM_EXT, 2048, 2048, 320);
+    }
+    GLenum err = glGetError();
+    // Allow GL_OUT_OF_MEMORY as the texture is large.
+    ASSERT_TRUE(err == GL_NO_ERROR || err == GL_OUT_OF_MEMORY);
+
+    if (err != GL_OUT_OF_MEMORY)
+    {
+        // Trigger deferred initialization by updating a small sub-region.
+        std::vector<GLubyte> data(16, 0);
+        glCompressedTexSubImage3D(GL_TEXTURE_3D, 0, 0, 0, 0, 4, 4, 1,
+                                  GL_COMPRESSED_RGBA_BPTC_UNORM_EXT, 16, data.data());
+        err = glGetError();
+        EXPECT_TRUE(err == GL_NO_ERROR || err == GL_OUT_OF_MEMORY);
+    }
+}
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(BPTCCompressedTextureTestES3WebGL);
+// The overflow happens in the "slow path" of initializeContents, which is only called if
+// robust resource initialization is enabled. Since it is always enabled in WebGL, we
+// enable it here to reproduce the bug.
+ANGLE_INSTANTIATE_TEST(BPTCCompressedTextureTestES3WebGL, ES3_D3D11());