From fc9650d1f398933dcf0ae1c1ca970b574b44bf17 Mon Sep 17 00:00:00 2001 From: Erico Nunes Date: Sun, 25 Jul 2021 13:48:59 +0200 Subject: [PATCH] lima: avoid crash with negative viewport values The viewport value computations done in lima_set_viewport_states can result in a negative value for viewport. These could end up converted to unsigned values in lima_clip_scissor_to_viewport causing crashes from invalid scissor commands. Prevent this by limiting the minimum value to zero as is already done for the left and bottom values. Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/2938 Cc: mesa-stable Signed-off-by: Erico Nunes Reviewed-by: Vasily Khoruzhick Part-of: (cherry picked from commit e6cdb01c517b42dece9ed532fd6eba7a74aa8f71) --- .pick_status.json | 2 +- src/gallium/drivers/lima/lima_draw.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.pick_status.json b/.pick_status.json index 5068d56d55b..e2e9c7f72d9 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -112,7 +112,7 @@ "description": "lima: avoid crash with negative viewport values", "nominated": true, "nomination_type": 0, - "resolution": 0, + "resolution": 1, "main_sha": null, "because_sha": null }, diff --git a/src/gallium/drivers/lima/lima_draw.c b/src/gallium/drivers/lima/lima_draw.c index 3d29fcc601b..161fc7288a5 100644 --- a/src/gallium/drivers/lima/lima_draw.c +++ b/src/gallium/drivers/lima/lima_draw.c @@ -72,14 +72,14 @@ lima_clip_scissor_to_viewport(struct lima_context *ctx) viewport_left = MAX2(ctx->viewport.left, 0); cscissor->minx = MAX2(cscissor->minx, viewport_left); - viewport_right = MIN2(ctx->viewport.right, fb->base.width); + viewport_right = MIN2(MAX2(ctx->viewport.right, 0), fb->base.width); cscissor->maxx = MIN2(cscissor->maxx, viewport_right); if (cscissor->minx > cscissor->maxx) cscissor->minx = cscissor->maxx; viewport_bottom = MAX2(ctx->viewport.bottom, 0); cscissor->miny = MAX2(cscissor->miny, viewport_bottom); - viewport_top = MIN2(ctx->viewport.top, fb->base.height); + viewport_top = MIN2(MAX2(ctx->viewport.top, 0), fb->base.height); cscissor->maxy = MIN2(cscissor->maxy, viewport_top); if (cscissor->miny > cscissor->maxy) cscissor->miny = cscissor->maxy;