fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-01-02 13:50:09 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

draw/so: Fix overflow calculations

Browse source 
We weren't taking the buffer offset, destination offset or the
stride into consideration so we were frequently writing into
an overflown buffer.

Signed-off-by: Zack Rusin <zackr@vmware.com>
Reviewed-by: José Fonseca <jfonseca@vmware.com>
Reviewed-by: Roland Scheidegger <sroland@vmware.com>
This commit is contained in:
Zack Rusin 2013-04-23 18:56:47 -04:00
parent d996622cfa
commit 53d36d5fb0
1 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
src/gallium/auxiliary/draw/draw_pt_so_emit.c
View file

@ -129,20 +129,25 @@ static void so_emit_prim(struct pt_so_emit *so,
for (i = 0; i < draw->so.num_targets; i++) {
struct draw_so_target *target = draw->so.targets[i];
buffer_total_bytes[i] = target->internal_offset;
buffer_total_bytes[i] = target->internal_offset + target->target.buffer_offset;
}
/* check have we space to emit prim first - if not don't do anything */
for (i = 0; i < num_vertices; ++i) {
unsigned ob;
for (slot = 0; slot < state->num_outputs; ++slot) {
unsigned num_comps = state->output[slot].num_components;
int ob = state->output[slot].output_buffer;
unsigned dst_offset = state->output[slot].dst_offset * sizeof(float);
unsigned write_size = num_comps * sizeof(float);
if ((buffer_total_bytes[ob] + num_comps * sizeof(float)) >
if ((buffer_total_bytes[ob] + write_size + dst_offset) >
draw->so.targets[ob]->target.buffer_size) {
return;
}
buffer_total_bytes[ob] += num_comps * sizeof(float);
}
for (ob = 0; ob < draw->so.num_targets; ++ob) {
buffer_total_bytes[ob] += state->stride[ob] * sizeof(float);
}
}