fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2025-12-21 13:40:16 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

glsl/linker: fix output variable overlap check

Browse source 
Prevent an overflow caused by too many output variables. To limit the
scope of the issue, write to the assigned array only for the non-ES
fragment shader path, which is the only place where it's needed.

Since the function will bail with an error when output variables with
overlapping components are found, (max # of FS outputs) * 4 is an upper
limit to the space we need.

Found by address sanitizer.

Fixes dEQP-GLES3.functional.attribute_location.bind_aliasing.*

Cc: mesa-stable@lists.freedesktop.org
Reviewed-by: Timothy Arceri <tarceri@itsqueeze.com>
This commit is contained in:
Nicolai Hähnle 2017-09-17 18:25:39 +02:00
parent 62a8ca22cd
commit 15cae12804
1 changed files with 11 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
src/compiler/glsl/linker.cpp
View file

@ -2651,12 +2651,14 @@ assign_attribute_or_color_locations(void *mem_ctx,
} to_assign[32]; } to_assign[32];
assert(max_index <= 32); assert(max_index <= 32);
/* Temporary array for the set of attributes that have locations assigned. /* Temporary array for the set of attributes that have locations assigned,
* for the purpose of checking overlapping slots/components of (non-ES)
* fragment shader outputs.
*/ */
ir_variable *assigned[16]; ir_variable *assigned[12 * 4]; /* (max # of FS outputs) * # components */
unsigned assigned_attr = 0;
unsigned num_attr = 0; unsigned num_attr = 0;
unsigned assigned_attr = 0;
foreach_in_list(ir_instruction, node, sh->ir) { foreach_in_list(ir_instruction, node, sh->ir) {
ir_variable *const var = node->as_variable(); ir_variable *const var = node->as_variable();
@ -2882,6 +2884,12 @@ assign_attribute_or_color_locations(void *mem_ctx,
} }
} }
} }
/* At most one variable per fragment output component should
* reach this. */
assert(assigned_attr < ARRAY_SIZE(assigned));
assigned[assigned_attr] = var;
assigned_attr++;
} else if (target_index == MESA_SHADER_FRAGMENT || } else if (target_index == MESA_SHADER_FRAGMENT ||
(prog->IsES && prog->data->Version >= 300)) { (prog->IsES && prog->data->Version >= 300)) {
linker_error(prog, "overlapping location is assigned " linker_error(prog, "overlapping location is assigned "
@ -2921,9 +2929,6 @@ assign_attribute_or_color_locations(void *mem_ctx,
double_storage_locations |= (use_mask << attr); double_storage_locations |= (use_mask << attr);
} }
assigned[assigned_attr] = var;
assigned_attr++;
continue; continue;
} }