From 87764963f25c51248406d400c8935228b19d4347 Mon Sep 17 00:00:00 2001 From: Mike Blumenkrantz Date: Thu, 30 Apr 2026 11:07:12 -0400 Subject: [PATCH] lavapipe: fix indirect memory copies this was using the wrong size for the copy cc: mesa-stable Part-of: --- src/gallium/frontends/lavapipe/lvp_execute.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/gallium/frontends/lavapipe/lvp_execute.c b/src/gallium/frontends/lavapipe/lvp_execute.c index 4d0cfc50ebb..7652a70e8f2 100644 --- a/src/gallium/frontends/lavapipe/lvp_execute.c +++ b/src/gallium/frontends/lavapipe/lvp_execute.c @@ -2667,16 +2667,18 @@ static void handle_copy_memory_indirect(struct vk_cmd_queue_entry *cmd, { const VkCopyMemoryIndirectInfoKHR *copycmd = cmd->u.copy_memory_indirect_khr.copy_memory_indirect_info; + uint8_t *base = (uint8_t*)(uintptr_t)copycmd->copyAddressRange.address; for (uint32_t i = 0; i < copycmd->copyCount; i++) { - uint8_t *ptr = (void*)(uintptr_t)copycmd->copyAddressRange.address; - VkCopyMemoryIndirectCommandKHR *copy = (void*)(ptr + i * copycmd->copyAddressRange.stride); + if (i * copycmd->copyAddressRange.stride > copycmd->copyAddressRange.size) + break; + VkCopyMemoryIndirectCommandKHR *copy = (void*)(base + i * copycmd->copyAddressRange.stride); void *src = (void*)(uintptr_t)copy->srcAddress; void *dst = (void*)(uintptr_t)copy->dstAddress; /* Techincally apps passing in size of zero still need valid pointers, * but in case they don't (which is easy to do) we don't want undefined behavior (or crash) in memcpy. */ if (copy->size != 0) - memcpy(dst, src, copycmd->copyAddressRange.size); + memcpy(dst, src, copy->size); } }