fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2025-12-30 18:40:13 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

brw: don't read past the end of old_src buffer in resize_sources()

Browse source 
In this case, num_sources is bigger than this->sources, so if we loop
up to num_sources (instead of this->sources) we'll end up reading past
the end of old_src[]. Only copy up to what we originally had.

This was found by code inspection, I'm not aware of any applications
failing due to the lack of this patch.

Fixes: d9e737212d ("intel/brw: Add a src array for the common case in fs_inst")
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
Reviewed-by: Caio Oliveira <caio.oliveira@intel.com>
Signed-off-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/32600>
This commit is contained in:
Paulo Zanoni 2024-12-11 15:57:25 -08:00 • committed by Marge Bot
parent c7a7f0244f
commit d4a54d4f92
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/intel/compiler/brw_fs.cpp
View file

@ -188,7 +188,7 @@ fs_inst::resize_sources(uint8_t num_sources)
} else {
new_src = new brw_reg[num_sources];
for (unsigned i = 0; i < num_sources; i++)
for (unsigned i = 0; i < this->sources; i++)
new_src[i] = old_src[i];
}