fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-03 18:38:11 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

r600: fix r600_draw_vbo() buffer overflow

Browse source 
The previous implementation was copying the data using the
aligned length (size_dw). The aligned length could overflow
the original buffer size.

For instance, this issue is triggered with "piglit/bin/draw-batch -auto -fbo":
==5736==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff139c77e8 at pc 0x7f25b350a9a0 bp 0x7fff139c6cb0 sp 0x7fff139c6460
READ of size 8 at 0x7fff139c77e8 thread T0
    #0 0x7f25b350a99f in __interceptor_memcpy (/usr/lib64/libasan.so.6+0x3c99f)
    #1 0x7f25a8fcdf24 in radeon_emit_array ../src/gallium/include/winsys/radeon_winsys.h:760
    #2 0x7f25a8fcdf24 in r600_draw_vbo ../src/gallium/drivers/r600/r600_state_common.c:2448
    #3 0x7f25a8ae7ba1 in u_vbuf_draw_vbo ../src/gallium/auxiliary/util/u_vbuf.c:1791
    #4 0x7f25a7bc18ca in _mesa_validated_drawrangeelements ../src/mesa/main/draw.c:1696
    #5 0x7f25a7bc7e53 in _mesa_DrawElements ../src/mesa/main/draw.c:1824

Fixes: 0cf5d1f226 ("gallium: remove PIPE_CAP_INFO_START_WITH_USER_INDICES and fix all drivers")
Signed-off-by: Patrick Lerda <patrick9876@free.fr>
Reviewed-by: Marek Olšák <marek.olsak@amd.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23436>
This commit is contained in:
Patrick Lerda 2023-06-02 01:33:03 +02:00 • committed by Marge Bot
parent ed759ad795
commit 340311dac9
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/gallium/drivers/r600/r600_state_common.c
View file

@ -2445,7 +2445,9 @@ static void r600_draw_vbo(struct pipe_context *ctx, const struct pipe_draw_info
radeon_emit(cs, PKT3(PKT3_DRAW_INDEX_IMMD, 1 + size_dw, render_cond_bit));
radeon_emit(cs, draws[0].count);
radeon_emit(cs, V_0287F0_DI_SRC_SEL_IMMEDIATE);
radeon_emit_array(cs, info->index.user + draws[0].start * index_size, size_dw);
memcpy(cs->current.buf + cs->current.cdw,
info->index.user + draws[0].start * index_size, size_bytes);
cs->current.cdw += size_dw;
} else {
uint64_t va = r600_resource(indexbuf)->gpu_address + index_offset;