fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-05 00:58:05 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

st/nine: Fix the number of texture stages

Browse source 
The number of texture stages is 8.

'tex_stage' array was too big, and thus
the checks with 'Elements(state->ff.tex_stage)' were passing,
causing some invalid API calls to pass, and crash because of
out of bounds write since bumpmap_vars was just the correct size.

Signed-off-by: Axel Davy <axel.davy@ens.fr>
This commit is contained in:
Axel Davy 2015-07-25 17:54:26 +02:00
parent f15ff98e2c
commit 1a747094ed
2 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/gallium/state_trackers/nine/nine_state.h
View file

@ -102,6 +102,8 @@
NINE_MAX_CONST_I * 4 * sizeof(int))
#define NINE_MAX_TEXTURE_STAGES 8
#define NINE_MAX_LIGHTS 65536
#define NINE_MAX_LIGHTS_ACTIVE 8
@ -156,7 +158,7 @@ struct nine_state
int ps_const_i[NINE_MAX_CONST_I][4];
BOOL ps_const_b[NINE_MAX_CONST_B];
float *ps_lconstf_temp;
uint32_t bumpmap_vars[48];
uint32_t bumpmap_vars[6 * NINE_MAX_TEXTURE_STAGES];
struct {
void *vs;
@ -191,7 +193,7 @@ struct nine_state
struct {
struct {
uint32_t group;
uint32_t tex_stage[NINE_MAX_SAMPLERS][(NINED3DTSS_COUNT + 31) / 32];
uint32_t tex_stage[NINE_MAX_TEXTURE_STAGES][(NINED3DTSS_COUNT + 31) / 32];
uint32_t transform[(NINED3DTS_COUNT + 31) / 32];
} changed;
@ -208,7 +210,7 @@ struct nine_state
D3DMATERIAL9 material;
DWORD tex_stage[NINE_MAX_SAMPLERS][NINED3DTSS_COUNT];
DWORD tex_stage[NINE_MAX_TEXTURE_STAGES][NINED3DTSS_COUNT];
} ff;
uint32_t commit;

2
src/gallium/state_trackers/nine/stateblock9.c
View file

@ -251,7 +251,7 @@ nine_state_copy_common(struct nine_state *dst,
dst->ff.material = src->ff.material;
if (mask->changed.group & NINE_STATE_FF_PSSTAGES) {
for (s = 0; s < NINE_MAX_SAMPLERS; ++s) {
for (s = 0; s < NINE_MAX_TEXTURE_STAGES; ++s) {
for (i = 0; i < NINED3DTSS_COUNT; ++i)
if (mask->ff.changed.tex_stage[s][i / 32] & (1 << (i % 32)))
dst->ff.tex_stage[s][i] = src->ff.tex_stage[s][i];