fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-05 20:28:04 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

mesa: fix out of bounds memory read in mipmap gen code

Browse source 
Out of bounds reads could happen for reducing WxH to WxH/2
or WxH to W/2xH.

Fixes fd.o bug 29918.
This commit is contained in:
Brian Paul 2010-09-01 13:21:51 -06:00
parent fd7f2ae085
commit 4ff3467daf
1 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
src/mesa/main/mipmap.c
View file

@ -1005,21 +1005,28 @@ make_2d_mipmap(GLenum datatype, GLuint comps, GLint border,
const GLint dstRowBytes = bpt * dstRowStride;
const GLubyte *srcA, *srcB;
GLubyte *dst;
GLint row;
GLint row, srcRowStep;
/* Compute src and dst pointers, skipping any border */
srcA = srcPtr + border * ((srcWidth + 1) * bpt);
if (srcHeight > 1)
if (srcHeight > 1 && srcHeight > dstHeight) {
/* sample from two source rows */
srcB = srcA + srcRowBytes;
else
srcRowStep = 2;
}
else {
/* sample from one source row */
srcB = srcA;
srcRowStep = 1;
}
dst = dstPtr + border * ((dstWidth + 1) * bpt);
for (row = 0; row < dstHeightNB; row++) {
do_row(datatype, comps, srcWidthNB, srcA, srcB,
dstWidthNB, dst);
srcA += 2 * srcRowBytes;
srcB += 2 * srcRowBytes;
srcA += srcRowStep * srcRowBytes;
srcB += srcRowStep * srcRowBytes;
dst += dstRowBytes;
}