fixup! fix(core): validate start + size for buffer ops in more places

Author: ErichDonGubler

wgpu-core/src/resource.rs

@@ -286,12 +286,20 @@ pub enum BufferAccessError {
         min: wgt::BufferAddress,
     },
     #[error(
-        "Buffer access out of bounds: last index {index} would overrun the buffer (limit: {max})"
+        "Buffer access out of bounds: start offset {index} would overrun the buffer (limit: {max})"
     )]
-    OutOfBoundsOverrun {
+    OutOfBoundsStartOffsetOverrun {
         index: wgt::BufferAddress,
         max: wgt::BufferAddress,
     },
+    #[error(
+        "Buffer access out of bounds: start offset {index} + size {size} would overrun the buffer (limit: {max})"
+    )]
+    OutOfBoundsEndOffsetOverrun {
+        index: wgt::BufferAddress,
+        size: wgt::BufferAddress,
+        max: wgt::BufferAddress,
+    },
     #[error("Buffer map range start {start} is greater than end {end}")]
     NegativeRange {
         start: wgt::BufferAddress,
@@ -335,7 +343,8 @@ impl WebGpuError for BufferAccessError {
             | Self::UnalignedOffset { .. }
             | Self::UnalignedRangeSize { .. }
             | Self::OutOfBoundsUnderrun { .. }
-            | Self::OutOfBoundsOverrun { .. }
+            | Self::OutOfBoundsStartOffsetOverrun { .. }
+            | Self::OutOfBoundsEndOffsetOverrun { .. }
             | Self::NegativeRange { .. }
             | Self::MapAborted
             | Self::MapStartOffsetOverrun { .. }
@@ -660,7 +669,7 @@ impl Buffer {
         if range.end > self.size {
             return Err((
                 op,
-                BufferAccessError::OutOfBoundsOverrun {
+                BufferAccessError::OutOfBoundsStartOffsetOverrun {
                     index: range.end,
                     max: self.size,
                 },
@@ -766,15 +775,22 @@ impl Buffer {
                 ref range,
                 ..
             } => {
+                if offset > range.end {
+                    return Err(BufferAccessError::OutOfBoundsStartOffsetOverrun {
+                        index: offset,
+                        max: range.end,
+                    });
+                }
                 if offset < range.start {
                     return Err(BufferAccessError::OutOfBoundsUnderrun {
                         index: offset,
                         min: range.start,
                     });
                 }
-                if offset + range_size > range.end {
-                    return Err(BufferAccessError::OutOfBoundsOverrun {
-                        index: offset + range_size - 1,
+                if range_size > offset - range.start {
+                    return Err(BufferAccessError::OutOfBoundsEndOffsetOverrun {
+                        index: offset,
+                        size: range_size,
                         max: range.end,
                     });
                 }