From bd625f7453198e0b51a4eb921e82de5d1c09b476 Mon Sep 17 00:00:00 2001 From: Pierre-Eric Pelloux-Prayer Date: Thu, 19 Jun 2025 10:17:50 +0200 Subject: [PATCH] tc: fix potential overflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported by static analysis. Multiplication may overflow before being converted to the larger type, so fix this by casting one of the operands to the destination type. Reviewed-by: Marek Olšák Part-of: --- src/gallium/auxiliary/util/u_threaded_context.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/gallium/auxiliary/util/u_threaded_context.c b/src/gallium/auxiliary/util/u_threaded_context.c index 8cba4cdedba..6522741a364 100644 --- a/src/gallium/auxiliary/util/u_threaded_context.c +++ b/src/gallium/auxiliary/util/u_threaded_context.c @@ -3183,13 +3183,16 @@ tc_texture_subdata(struct pipe_context *_pipe, { struct threaded_context *tc = threaded_context(_pipe); uint64_t size; + uint32_t last_row_stride; assert(box->height >= 1); assert(box->depth >= 1); + last_row_stride = box->width * util_format_get_blocksize(resource->format); + size = (box->depth - 1) * layer_stride + (box->height - 1) * (uint64_t)stride + - box->width * util_format_get_blocksize(resource->format); + last_row_stride; if (!size) return;