spirv: fix OpUntypedVariableKHR with optional data type parameter

This would read OOB and crash because data type is optional per the
SPIRV spec.

Original patch by Faith Ekstrand <faith.ekstrand@collabora.com>.

Cc: mesa-stable
Signed-off-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/40731>
This commit is contained in:
Samuel Pitoiset 2026-03-31 17:55:53 +02:00 committed by Marge Bot
parent eff9f00533
commit 1f8be7bfad

View file

@ -2769,7 +2769,13 @@ vtn_handle_variables(struct vtn_builder *b, SpvOp opcode,
const bool untyped = opcode == SpvOpUntypedVariableKHR;
struct vtn_type *ptr_type = vtn_get_type(b, w[1]);
struct vtn_type *data_type = untyped ? vtn_get_type(b, w[4]) : ptr_type->pointed;
struct vtn_type *data_type =
untyped && count > 4 ? vtn_get_type(b, w[4]) : ptr_type->pointed;
if (data_type == NULL) {
data_type = vtn_zalloc(b, struct vtn_type);
data_type->base_type = vtn_base_type_void;
data_type->type = glsl_void_type();
}
SpvStorageClass storage_class = w[3];