layers: GH934 Bounds checking on SetScissor

Change-Id: I3b14cc79f851eb66401da659cb0dade9888d84a8

2 files changed, 31 insertions, 3 deletions

diff --git a/layers/parameter_validation.cpp b/layers/parameter_validation.cpp
index 4064e6fd..0cc31a11 100644
--- a/layers/parameter_validation.cpp
+++ b/layers/parameter_validation.cpp
@@ -23,6 +23,7 @@
 
 #define NOMINMAX
 
+#include <limits.h>
 #include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -3992,9 +3993,36 @@ VKAPI_ATTR void VKAPI_CALL CmdSetScissor(VkCommandBuffer commandBuffer, uint32_t
     bool skip_call = false;
     layer_data *my_data = get_my_data_ptr(get_dispatch_key(commandBuffer), layer_data_map);
     assert(my_data != NULL);
+    debug_report_data *report_data = my_data->report_data;
 
     skip_call |= parameter_validation_vkCmdSetScissor(my_data->report_data, firstScissor, scissorCount, pScissors);
 
+    for (uint32_t scissorIndex = 0; scissorIndex < scissorCount; ++scissorIndex) {
+        const VkRect2D &pScissor = pScissors[scissorIndex];
+
+        if (pScissor.offset.x < 0) {
+            skip_call |= log_msg(report_data, VK_DEBUG_REPORT_ERROR_BIT_EXT, VK_DEBUG_REPORT_OBJECT_TYPE_UNKNOWN_EXT, 0, __LINE__,
+                                 VALIDATION_ERROR_01489, LayerName, "vkCmdSetScissor %d: offset.x (%d) must not be negative. %s",
+                                 scissorIndex, pScissor.offset.x, validation_error_map[VALIDATION_ERROR_01489]);
+        } else if (static_cast<int32_t>(pScissor.extent.width) > (INT_MAX - pScissor.offset.x)) {
+            skip_call |= log_msg(report_data, VK_DEBUG_REPORT_ERROR_BIT_EXT, VK_DEBUG_REPORT_OBJECT_TYPE_UNKNOWN_EXT, 0, __LINE__,
+                                 VALIDATION_ERROR_01490, LayerName,
+                                 "vkCmdSetScissor %d: adding offset.x (%d) and extent.width (%u) will overflow. %s", scissorIndex,
+                                 pScissor.offset.x, pScissor.extent.width, validation_error_map[VALIDATION_ERROR_01490]);
+        }
+
+        if (pScissor.offset.y < 0) {
+            skip_call |= log_msg(report_data, VK_DEBUG_REPORT_ERROR_BIT_EXT, VK_DEBUG_REPORT_OBJECT_TYPE_UNKNOWN_EXT, 0, __LINE__,
+                                 VALIDATION_ERROR_01489, LayerName, "vkCmdSetScissor %d: offset.y (%d) must not be negative. %s",
+                                 scissorIndex, pScissor.offset.y, validation_error_map[VALIDATION_ERROR_01489]);
+        } else if (static_cast<int32_t>(pScissor.extent.height) > (INT_MAX - pScissor.offset.y)) {
+            skip_call |= log_msg(report_data, VK_DEBUG_REPORT_ERROR_BIT_EXT, VK_DEBUG_REPORT_OBJECT_TYPE_UNKNOWN_EXT, 0, __LINE__,
+                                 VALIDATION_ERROR_01491, LayerName,
+                                 "vkCmdSetScissor %d: adding offset.y (%d) and extent.height (%u) will overflow. %s", scissorIndex,
+                                 pScissor.offset.y, pScissor.extent.height, validation_error_map[VALIDATION_ERROR_01491]);
+        }
+    }
+
     if (!skip_call) {
         get_dispatch_table(pc_device_table_map, commandBuffer)->CmdSetScissor(commandBuffer, firstScissor, scissorCount, pScissors);
     }
diff --git a/layers/vk_validation_error_database.txt b/layers/vk_validation_error_database.txt
index 7cbfc10c..d93408d3 100644
--- a/layers/vk_validation_error_database.txt
+++ b/layers/vk_validation_error_database.txt
@@ -1471,9 +1471,9 @@ VALIDATION_ERROR_01485~^~U~^~Unknown~^~vkCmdSetDepthBias~^~For more information
 VALIDATION_ERROR_01486~^~U~^~Unknown~^~vkCmdSetScissor~^~For more information refer to Vulkan Spec Section '25.2. Scissor Test' which states 'The currently bound graphics pipeline must have been created with the VK_DYNAMIC_STATE_SCISSOR dynamic state enabled' (https://www.khronos.org/registry/vulkan/specs/1.0-extensions/xhtml/vkspec.html#vkCmdSetScissor)~^~
 VALIDATION_ERROR_01487~^~U~^~Unknown~^~vkCmdSetScissor~^~For more information refer to Vulkan Spec Section '25.2. Scissor Test' which states 'firstScissor must be less than VkPhysicalDeviceLimits::maxViewports' (https://www.khronos.org/registry/vulkan/specs/1.0-extensions/xhtml/vkspec.html#vkCmdSetScissor)~^~
 VALIDATION_ERROR_01488~^~U~^~Unknown~^~vkCmdSetScissor~^~For more information refer to Vulkan Spec Section '25.2. Scissor Test' which states 'The sum of firstScissor and scissorCount must be between 1 and VkPhysicalDeviceLimits::maxViewports, inclusive' (https://www.khronos.org/registry/vulkan/specs/1.0-extensions/xhtml/vkspec.html#vkCmdSetScissor)~^~
-VALIDATION_ERROR_01489~^~U~^~Unknown~^~vkCmdSetScissor~^~For more information refer to Vulkan Spec Section '25.2. Scissor Test' which states 'The x and y members of offset must be greater than or equal to 0' (https://www.khronos.org/registry/vulkan/specs/1.0-extensions/xhtml/vkspec.html#vkCmdSetScissor)~^~
-VALIDATION_ERROR_01490~^~U~^~Unknown~^~vkCmdSetScissor~^~For more information refer to Vulkan Spec Section '25.2. Scissor Test' which states 'Evaluation of (offset.x + extent.width) must not cause a signed integer addition overflow' (https://www.khronos.org/registry/vulkan/specs/1.0-extensions/xhtml/vkspec.html#vkCmdSetScissor)~^~
-VALIDATION_ERROR_01491~^~U~^~Unknown~^~vkCmdSetScissor~^~For more information refer to Vulkan Spec Section '25.2. Scissor Test' which states 'Evaluation of (offset.y + extent.height) must not cause a signed integer addition overflow' (https://www.khronos.org/registry/vulkan/specs/1.0-extensions/xhtml/vkspec.html#vkCmdSetScissor)~^~
+VALIDATION_ERROR_01489~^~Y~^~ViewportBoundsChecking~^~vkCmdSetScissor~^~For more information refer to Vulkan Spec Section '25.2. Scissor Test' which states 'The x and y members of offset must be greater than or equal to 0' (https://www.khronos.org/registry/vulkan/specs/1.0-extensions/xhtml/vkspec.html#vkCmdSetScissor)~^~
+VALIDATION_ERROR_01490~^~Y~^~ViewportBoundsChecking~^~vkCmdSetScissor~^~For more information refer to Vulkan Spec Section '25.2. Scissor Test' which states 'Evaluation of (offset.x + extent.width) must not cause a signed integer addition overflow' (https://www.khronos.org/registry/vulkan/specs/1.0-extensions/xhtml/vkspec.html#vkCmdSetScissor)~^~
+VALIDATION_ERROR_01491~^~Y~^~ViewportBoundsChecking~^~vkCmdSetScissor~^~For more information refer to Vulkan Spec Section '25.2. Scissor Test' which states 'Evaluation of (offset.y + extent.height) must not cause a signed integer addition overflow' (https://www.khronos.org/registry/vulkan/specs/1.0-extensions/xhtml/vkspec.html#vkCmdSetScissor)~^~
 VALIDATION_ERROR_01492~^~Y~^~Unknown~^~vkCmdSetScissor~^~For more information refer to Vulkan Spec Section '25.2. Scissor Test' which states 'commandBuffer must be a valid VkCommandBuffer handle' (https://www.khronos.org/registry/vulkan/specs/1.0-extensions/xhtml/vkspec.html#vkCmdSetScissor)~^~
 VALIDATION_ERROR_01493~^~U~^~Unknown~^~vkCmdSetScissor~^~For more information refer to Vulkan Spec Section '25.2. Scissor Test' which states 'pScissors must be a pointer to an array of scissorCount VkRect2D structures' (https://www.khronos.org/registry/vulkan/specs/1.0-extensions/xhtml/vkspec.html#vkCmdSetScissor)~^~
 VALIDATION_ERROR_01494~^~U~^~Unknown~^~vkCmdSetScissor~^~For more information refer to Vulkan Spec Section '25.2. Scissor Test' which states 'commandBuffer must be in the recording state' (https://www.khronos.org/registry/vulkan/specs/1.0-extensions/xhtml/vkspec.html#vkCmdSetScissor)~^~