fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-06 05:08:08 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

i965: Handle non-zero texture buffer offsets in buffer object range calculation.

Browse source 
Otherwise the specified surface state will allow the GPU to access
memory up to BufferOffset bytes past the end of the buffer.  Found by
inspection.

v2: Protect against out-of-range BufferOffset (Nanley).
Cc: mesa-stable@lists.freedesktop.org
Reviewed-by: Nanley Chery <nanley.g.chery@intel.com>
(cherry picked from commit e989acb03b)
This commit is contained in:
Francisco Jerez 2018-03-16 14:35:10 -07:00 • committed by Juan A. Suarez Romero
parent 03eaee1529
commit 86e749a96e
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/mesa/drivers/dri/i965/brw_wm_surface_state.c
View file

@ -610,6 +610,7 @@ buffer_texture_range_size(struct brw_context *brw,
const unsigned texel_size = _mesa_get_format_bytes(obj->_BufferObjectFormat);
const unsigned buffer_size = (!obj->BufferObject ? 0 :
obj->BufferObject->Size);
const unsigned buffer_offset = MIN2(buffer_size, obj->BufferOffset);
/* The ARB_texture_buffer_specification says:
*
@ -627,7 +628,8 @@ buffer_texture_range_size(struct brw_context *brw,
* so that when ISL divides by stride to obtain the number of texels, that
* texel count is clamped to MAX_TEXTURE_BUFFER_SIZE.
*/
return MIN3((unsigned)obj->BufferSize, buffer_size,
return MIN3((unsigned)obj->BufferSize,
buffer_size - buffer_offset,
brw->ctx.Const.MaxTextureBufferSize * texel_size);
}