fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-09 11:08:03 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

i965: Fix out-of-bounds accesses into pull_constant_loc array

Browse source 
The piglit test glsl-fs-uniform-array-loop-unroll.shader_test was designed
to do an out of bounds access into an uniform array to make sure that we
handle that situation gracefully inside the driver, however, as Ken describes
in bug 79202, Valgrind reports that this is leading to an out-of-bounds access
in fs_visitor::demote_pull_constants().

Before accessing the pull_constant_loc array we should make sure that
the uniform we are trying to access is valid.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=79202
Reviewed-by: Matt Turner <mattst88@gmail.com>
(cherry picked from commit 6ac1bc90c4)
Nominated-by: Matt Turner <mattst88@gmail.com>
This commit is contained in:
Iago Toral Quiroga 2015-03-10 11:36:43 +01:00 • committed by Emil Velikov
parent a91ee1e187
commit 8c25b0f2d1
1 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/mesa/drivers/dri/i965/brw_fs.cpp
View file

@ -2179,8 +2179,13 @@ fs_visitor::demote_pull_constants()
if (inst->src[i].file != UNIFORM)
continue;
int pull_index = pull_constant_loc[inst->src[i].reg +
inst->src[i].reg_offset];
int pull_index;
unsigned location = inst->src[i].reg + inst->src[i].reg_offset;
if (location >= uniforms) /* Out of bounds access */
pull_index = -1;
else
pull_index = pull_constant_loc[location];
if (pull_index == -1)
continue;