From f3b0f8b2c7d2052b44dafa6a15598175ff1dece0 Mon Sep 17 00:00:00 2001
From: Jeff Gilbert <jgilbert@mozilla.com>
Date: Thu, 7 Jan 2016 16:22:45 -0800
Subject: [PATCH] Bug 1237637 - Disallow negative levels for framebuffer
 attachments. - r=jrmuizel

---
 dom/canvas/WebGLContextGL.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/dom/canvas/WebGLContextGL.cpp b/dom/canvas/WebGLContextGL.cpp
index a0a5aef4dd1d..2c26b353b6f3 100644
--- a/dom/canvas/WebGLContextGL.cpp
+++ b/dom/canvas/WebGLContextGL.cpp
@@ -537,6 +537,11 @@ WebGLContext::FramebufferTexture2D(GLenum target,
     if (!ValidateFramebufferTarget(target, "framebufferTexture2D"))
         return;
 
+    if (level < 0) {
+        ErrorInvalidValue("framebufferTexture2D: level must not be negative.");
+        return;
+    }
+
     if (!IsWebGL2() && level != 0) {
         ErrorInvalidValue("framebufferTexture2D: level must be 0.");
         return;