fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2025-12-27 01:50:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

nv50: assert before trying to out-of-bounds access vtxbuf

Browse source 
Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Reviewed-by: Ilia Mirkin <imirkin@alum.mit.edu>
This commit is contained in:
Emil Velikov 2014-01-16 16:53:45 +00:00
parent 741e935a72
commit 1773611c52
3 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/gallium/drivers/nouveau/nv50/nv50_context.c
View file

@ -80,6 +80,7 @@ nv50_context_unreference_resources(struct nv50_context *nv50)
util_unreference_framebuffer_state(&nv50->framebuffer);
assert(nv50->num_vtxbufs <= PIPE_MAX_ATTRIBS);
for (i = 0; i < nv50->num_vtxbufs; ++i)
pipe_resource_reference(&nv50->vtxbuf[i].buffer, NULL);
@ -149,6 +150,7 @@ nv50_invalidate_resource_storage(struct nouveau_context *ctx,
}
if (res->bind & PIPE_BIND_VERTEX_BUFFER) {
assert(nv50->num_vtxbufs <= PIPE_MAX_ATTRIBS);
for (i = 0; i < nv50->num_vtxbufs; ++i) {
if (nv50->vtxbuf[i].buffer == res) {
nv50->dirty |= NV50_NEW_ARRAYS;

1
src/gallium/drivers/nouveau/nv50/nv50_push.c
View file

@ -219,6 +219,7 @@ nv50_push_vbo(struct nv50_context *nv50, const struct pipe_draw_info *info)
ctx.packet_vertex_limit = nv50->vertex->packet_vertex_limit;
ctx.vertex_words = nv50->vertex->vertex_size;
assert(nv50->num_vtxbufs <= PIPE_MAX_ATTRIBS);
for (i = 0; i < nv50->num_vtxbufs; ++i) {
const struct pipe_vertex_buffer *vb = &nv50->vtxbuf[i];
const uint8_t *data;

12
src/gallium/drivers/nouveau/nv50/nv50_vbo.c
View file

@ -192,6 +192,7 @@ static INLINE void
nv50_user_vbuf_range(struct nv50_context *nv50, int vbi,
uint32_t *base, uint32_t *size)
{
assert(vbi < PIPE_MAX_ATTRIBS);
if (unlikely(nv50->vertex->instance_bufs & (1 << vbi))) {
/* TODO: use min and max instance divisor to get a proper range */
*base = 0;
@ -211,6 +212,7 @@ nv50_upload_user_buffers(struct nv50_context *nv50,
{
unsigned b;
assert(nv50->num_vtxbufs <= PIPE_MAX_ATTRIBS);
for (b = 0; b < nv50->num_vtxbufs; ++b) {
struct nouveau_bo *bo;
const struct pipe_vertex_buffer *vb = &nv50->vtxbuf[b];
@ -241,9 +243,12 @@ nv50_update_user_vbufs(struct nv50_context *nv50)
for (i = 0; i < nv50->vertex->num_elements; ++i) {
struct pipe_vertex_element *ve = &nv50->vertex->element[i].pipe;
const unsigned b = ve->vertex_buffer_index;
struct pipe_vertex_buffer *vb = &nv50->vtxbuf[b];
struct pipe_vertex_buffer *vb;
uint32_t base, size;
assert(b < PIPE_MAX_ATTRIBS);
vb = &nv50->vtxbuf[b];
if (!(nv50->vbo_user & (1 << b)))
continue;
@ -306,6 +311,7 @@ nv50_vertex_arrays_validate(struct nv50_context *nv50)
if (!nv50->vbo_fifo) {
/* if vertex buffer was written by GPU - flush VBO cache */
assert(nv50->num_vtxbufs <= PIPE_MAX_ATTRIBS);
for (i = 0; i < nv50->num_vtxbufs; ++i) {
struct nv04_resource *buf = nv04_resource(nv50->vtxbuf[i].buffer);
if (buf && buf->status & NOUVEAU_BUFFER_STATUS_GPU_WRITING) {
@ -332,6 +338,8 @@ nv50_vertex_arrays_validate(struct nv50_context *nv50)
}
for (i = 0; i < vertex->num_elements; ++i) {
const unsigned b = vertex->element[i].pipe.vertex_buffer_index;
assert(b < PIPE_MAX_ATTRIBS);
ve = &vertex->element[i];
vb = &nv50->vtxbuf[b];
@ -360,6 +368,8 @@ nv50_vertex_arrays_validate(struct nv50_context *nv50)
for (i = 0; i < vertex->num_elements; ++i) {
uint64_t address, limit;
const unsigned b = vertex->element[i].pipe.vertex_buffer_index;
assert(b < PIPE_MAX_ATTRIBS);
ve = &vertex->element[i];
vb = &nv50->vtxbuf[b];