fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2025-12-24 21:50:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

freedreno/a6xx: Fix UB in convert_color()

Browse source 
Swizzle can include PIPE_SWIZZLE_0/_1 (4 and 5) which result in indexing
beyond the channel array.

Reported-by: Danylo Piliaiev <dpiliaiev@igalia.com>
Fixes: 76e350671f ("freedreno/a6xx: Sysmem clear fixes")
Signed-off-by: Rob Clark <rob.clark@oss.qualcomm.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/38593>
(cherry picked from commit f0465ced7f)
This commit is contained in:
Rob Clark 2025-11-22 09:02:23 -08:00 • committed by Eric Engestrom
parent bc639539af
commit a4350c69b4
2 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.pick_status.json
View file

@ -4034,7 +4034,7 @@
"description": "freedreno/a6xx: Fix UB in convert_color()",
"nominated": true,
"nomination_type": 2,
"resolution": 0,
"resolution": 1,
"main_sha": null,
"because_sha": "76e350671f3ba2d8ccbe6851de868d8897a8bb98",
"notes": null

3
src/gallium/drivers/freedreno/a6xx/fd6_blitter.cc
View file

@ -862,6 +862,9 @@ convert_color(enum pipe_format format, union pipe_color_union *pcolor)
for (unsigned i = 0; i < 4; i++) {
unsigned channel = desc->swizzle[i];
if (channel >= 4) /* PIPE_SWIZZLE_0/_1 */
continue;
if (desc->channel[channel].normalized)
continue;