Validate the range in map_async. (#2876)

* Validate the range in map_async.

* Add an entry in the changelog.

CHANGELOG.md

@@ -49,6 +49,7 @@ Bottom level categories:
 - `get_texture_format_features` only lists the COPY_* usages if the adapter actually supports that usage by @cwfitzgerald in [#2856](https://github.com/gfx-rs/wgpu/pull/2856)
 - Fix bind group / pipeline deduplication not taking into account RenderBundle execution resetting these values by @shoebe [#2867](https://github.com/gfx-rs/wgpu/pull/2867)
 - Fix panics that occur when using `as_hal` functions when the hal generic type does not match the hub being looked up in by @i509VCB [#2871](https://github.com/gfx-rs/wgpu/pull/2871)
+- Add some validation in map_async by @nical in [#2876](https://github.com/gfx-rs/wgpu/pull/2876)
 
 #### DX12
 - `DownlevelCapabilities::default()` now returns the `ANISOTROPIC_FILTERING` flag set to true so DX12 lists `ANISOTROPIC_FILTERING` as true again by @cwfitzgerald in [#2851](https://github.com/gfx-rs/wgpu/pull/2851)

wgpu-core/src/device/mod.rs

@@ -5354,6 +5354,14 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
                 .map_err(|_| resource::BufferAccessError::Invalid)?;
 
             check_buffer_usage(buffer.usage, pub_usage)?;
+
+            if range.end > buffer.size {
+                return Err(resource::BufferAccessError::OutOfBoundsOverrun {
+                    index: range.end,
+                    max: buffer.size,
+                });
+            }
+
             buffer.map_state = match buffer.map_state {
                 resource::BufferMapState::Init { .. } | resource::BufferMapState::Active { .. } => {
                     return Err(resource::BufferAccessError::AlreadyMapped);