LibWeb/WebGL2: Correctly handle offsets in uniform(Matrix) functions

Meta/Lagom/Tools/CodeGenerators/LibWeb/GenerateWebGLRenderingContext.cpp

@@ -923,14 +923,16 @@ public:
 
             if (webgl_version == 2) {
                 function_impl_generator.append(R"~~~(
+    if (src_offset + src_length > (count * matrix_size)) {
+        set_error(GL_INVALID_VALUE);
+        return;
+    }
+
     raw_data += src_offset;
     if (src_length == 0) {
         count -= src_offset;
-    }
-
-    if (src_offset + src_length <= count) {
-        set_error(GL_INVALID_VALUE);
-        return;
+    } else {
+        count = src_length;
     }
 )~~~");
             }
@@ -975,14 +977,16 @@ public:
 
             if (webgl_version == 2) {
                 function_impl_generator.append(R"~~~(
+    if (src_offset + src_length > count) {
+        set_error(GL_INVALID_VALUE);
+        return;
+    }
+
     data += src_offset;
     if (src_length == 0) {
         count -= src_offset;
-    }
-
-    if (src_offset + src_length <= count) {
-        set_error(GL_INVALID_VALUE);
-        return;
+    } else {
+        count = src_length;
     }
 )~~~");
             }