fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2025-12-24 11:00:11 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

glsl: avoid stack smashing when there are too many attributes

Browse source 
This fixes a crash in

dEQP-GLES3.functional.transform_feedback.array_element.separate.points.lowp_mat3x2

and likely others. The vertex shader has > 16 input variables (without
explicit locations), which causes us to index outside of the to_assign
array.

Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Reviewed-by: Timothy Arceri <timothy.arceri@collabora.com>
Cc: "11.1 11.2" <mesa-stable@lists.freedesktop.org>
This commit is contained in:
Ilia Mirkin 2016-03-06 12:19:04 -05:00
parent 3dd0441f6c
commit f6827e20d1
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/compiler/glsl/linker.cpp
View file

@ -2625,6 +2625,13 @@ assign_attribute_or_color_locations(gl_shader_program *prog,
continue;
}
if (num_attr >= ARRAY_SIZE(to_assign)) {
linker_error(prog, "too many %s (max %u)",
target_index == MESA_SHADER_VERTEX ?
"vertex shader inputs" : "fragment shader outputs",
(unsigned)ARRAY_SIZE(to_assign));
return false;
}
to_assign[num_attr].slots = slots;
to_assign[num_attr].var = var;
num_attr++;