fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-04-28 02:10:37 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

nv50,nvc0: avoid reading out of bounds when getting bogus so info

Browse source 
The state tracker tries to attach the info to the wrong shader. This is
easy enough to protect against.

Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Reviewed-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
Cc: 12.0 13.0 <mesa-stable@lists.freedesktop.org>
This commit is contained in:
Ilia Mirkin 2016-10-19 00:05:26 -04:00
parent 8bf7717e1f
commit 313fba5ee1
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/gallium/drivers/nouveau/nv50/nv50_program.c
View file

@ -307,6 +307,9 @@ nv50_program_create_strmout_state(const struct nv50_ir_prog_info *info,
const unsigned r = pso->output[i].register_index;
b = pso->output[i].output_buffer;
if (r >= info->numOutputs)
continue;
for (c = 0; c < pso->output[i].num_components; ++c)
so->map[base[b] + p + c] = info->out[r].slot[s + c];
}

7
src/gallium/drivers/nouveau/nvc0/nvc0_program.c
View file

@ -509,11 +509,14 @@ nvc0_program_create_tfb_state(const struct nv50_ir_prog_info *info,
for (i = 0; i < pso->num_outputs; ++i) {
unsigned s = pso->output[i].start_component;
unsigned p = pso->output[i].dst_offset;
const unsigned r = pso->output[i].register_index;
b = pso->output[i].output_buffer;
if (r >= info->numOutputs)
continue;
for (c = 0; c < pso->output[i].num_components; ++c)
tfb->varying_index[b][p++] =
info->out[pso->output[i].register_index].slot[s + c];
tfb->varying_index[b][p++] = info->out[r].slot[s + c];
tfb->varying_count[b] = MAX2(tfb->varying_count[b], p);
tfb->stream[b] = pso->output[i].stream;