fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-09 04:38:03 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

nir/lower_samplers: Clamp out-of-bounds access to array of samplers

Browse source 
Section 5.11 (Out-of-Bounds Accesses) of the GLSL 4.60 spec says:

"In the subsections described above for array, vector, matrix and
 structure accesses, any out-of-bounds access produced undefined
 behavior.... Out-of-bounds reads return undefined values, which
 include values from other variables of the active program or zero."

Robustness extensions suggest to return zero on out-of-bounds
accesses, however it's not applicable to the arrays of samplers,
so just clamp the index.

Otherwise instr->sampler_index or instr->texture_index would be out
of bounds, and they are used as an index to arrays of driver state.

E.g. this fixes such dereference:
 if (options->lower_tex_packing[tex->sampler_index] !=
in nir_lower_tex.c

CC: <mesa-stable@lists.freedesktop.org>
Signed-off-by: Danylo Piliaiev <danylo.piliaiev@globallogic.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/6428>
(cherry picked from commit f2b17dec12)
This commit is contained in:
Danylo Piliaiev 2020-08-21 17:21:14 +03:00 • committed by Eric Engestrom
parent ef29f3758e
commit 46762687a0
2 changed files with 22 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.pick_status.json
View file

@ -418,7 +418,7 @@
"description": "nir/lower_samplers: Clamp out-of-bounds access to array of samplers",
"nominated": true,
"nomination_type": 0,
"resolution": 0,
"resolution": 1,
"master_sha": null,
"because_sha": null
},

22
src/compiler/nir/nir_lower_samplers.c
View file

@ -47,7 +47,27 @@ lower_tex_src_to_offset(nir_builder *b,
if (nir_src_is_const(deref->arr.index) && index == NULL) {
/* We're still building a direct index */
base_index += nir_src_as_uint(deref->arr.index) * array_elements;
unsigned index_in_array = nir_src_as_uint(deref->arr.index);
/* Section 5.11 (Out-of-Bounds Accesses) of the GLSL 4.60 spec says:
*
* In the subsections described above for array, vector, matrix and
* structure accesses, any out-of-bounds access produced undefined
* behavior.... Out-of-bounds reads return undefined values, which
* include values from other variables of the active program or zero.
*
* Robustness extensions suggest to return zero on out-of-bounds
* accesses, however it's not applicable to the arrays of samplers,
* so just clamp the index.
*
* Otherwise instr->sampler_index or instr->texture_index would be out
* of bounds, and they are used as an index to arrays of driver state.
*/
if (index_in_array < glsl_array_size(parent->type)) {
base_index += index_in_array * array_elements;
} else {
base_index = glsl_array_size(parent->type) - 1;
}
} else {
if (index == NULL) {
/* We used to be direct but not anymore */