fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-07 15:48:36 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

nv50,nvc0: avoid reading out of bounds when getting bogus so info

Browse source 
The state tracker tries to attach the info to the wrong shader. This is
easy enough to protect against.

Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Reviewed-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
Cc: 12.0 13.0 <mesa-stable@lists.freedesktop.org>
(cherry picked from commit 313fba5ee1)
This commit is contained in:
Ilia Mirkin 2016-10-19 00:05:26 -04:00 • committed by Emil Velikov
parent 4768b7353f
commit 05b89cf40e
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/gallium/drivers/nouveau/nv50/nv50_program.c
View file

@ -307,6 +307,9 @@ nv50_program_create_strmout_state(const struct nv50_ir_prog_info *info,
const unsigned r = pso->output[i].register_index;
b = pso->output[i].output_buffer;
if (r >= info->numOutputs)
continue;
for (c = 0; c < pso->output[i].num_components; ++c)
so->map[base[b] + p + c] = info->out[r].slot[s + c];
}

7
src/gallium/drivers/nouveau/nvc0/nvc0_program.c
View file

@ -509,11 +509,14 @@ nvc0_program_create_tfb_state(const struct nv50_ir_prog_info *info,
for (i = 0; i < pso->num_outputs; ++i) {
unsigned s = pso->output[i].start_component;
unsigned p = pso->output[i].dst_offset;
const unsigned r = pso->output[i].register_index;
b = pso->output[i].output_buffer;
if (r >= info->numOutputs)
continue;
for (c = 0; c < pso->output[i].num_components; ++c)
tfb->varying_index[b][p++] =
info->out[pso->output[i].register_index].slot[s + c];
tfb->varying_index[b][p++] = info->out[r].slot[s + c];
tfb->varying_count[b] = MAX2(tfb->varying_count[b], p);
tfb->stream[b] = pso->output[i].stream;