fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-04 20:38:06 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

v3dv: duplicate key on hashtable insert

Browse source 
The key is created on stack, so as soon as the function returns this key
is lost, so the inserted key in the hashtable is invalid.

Rather, insert a duplicated version on heap.

This fixes a stack-buffer-overflow when running some Vulkan CTS tests.

Signed-off-by: Juan A. Suarez Romero <jasuarez@igalia.com>
Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/16083>
This commit is contained in:
Juan A. Suarez Romero 2022-04-21 16:26:39 +02:00 • committed by Marge Bot
parent 39cebe24ae
commit 697e98c66e
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/broadcom/vulkan/v3dv_meta_copy.c
View file

@ -1885,7 +1885,7 @@ get_copy_texel_buffer_pipeline(
mtx_lock(&device->meta.mtx);
struct hash_entry *entry =
_mesa_hash_table_search(device->meta.texel_buffer_copy.cache[image_type],
&key);
key);
if (entry) {
mtx_unlock(&device->meta.mtx);
*pipeline = entry->data;
@ -1914,8 +1914,10 @@ get_copy_texel_buffer_pipeline(
if (!ok)
goto fail;
uint8_t *dupkey = malloc(V3DV_META_TEXEL_BUFFER_COPY_CACHE_KEY_SIZE);
memcpy(dupkey, key, V3DV_META_TEXEL_BUFFER_COPY_CACHE_KEY_SIZE);
_mesa_hash_table_insert(device->meta.texel_buffer_copy.cache[image_type],
&key, *pipeline);
dupkey, *pipeline);
mtx_unlock(&device->meta.mtx);
return true;