fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-17 20:28:05 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
mesa/src
History
Chris Wilson 5b09cf5c57 i915: out-of-bounds write in calc_live_regs() 
From a Coverity defect report.

src/mesa/drivers/dri/i915/i915_fragprog.c
   301  /*
   302   * TODO: consider moving this into core
   303   */
   304  static bool calc_live_regs( struct i915_fragment_program *p )
   305  {
   306      const struct gl_fragment_program *program = &p->FragProg;
   307      GLuint regsUsed = 0xffff0000;
-> 308      uint8_t live_components[16] = { 0, };
   309      GLint i;
   310
   311      for (i = program->Base.NumInstructions - 1; i >= 0; i--) {
   312          struct prog_instruction *inst =
&program->Base.Instructions[i];
   313          int opArgs = _mesa_num_inst_src_regs(inst->Opcode);
   314          int a;
   315
   316          /* Register is written to: unmark as live for this and
preceeding ops */
   317          if (inst->DstReg.File == PROGRAM_TEMPORARY) {
-> 318              if (inst->DstReg.Index > 16)
   319                 return false;
   320
-> 321              live_components[inst->DstReg.Index] &= ~inst->DstReg.WriteMask;
   322              if (live_components[inst->DstReg.Index] == 0)
   323                  regsUsed &= ~(1 << inst->DstReg.Index);
   324          }
   325
   326          for (a = 0; a < opArgs; a++) {
   327              /* Register is read from: mark as live for this and preceeding ops */
   328              if (inst->SrcReg[a].File == PROGRAM_TEMPORARY) {
   329                  unsigned c;
   330
   331                  if (inst->SrcReg[a].Index > 16)
   332                     return false;
   333
   334                  regsUsed |= 1 << inst->SrcReg[a].Index;
   335
   336                  for (c = 0; c < 4; c++) {
   337                      const unsigned field = GET_SWZ(inst->SrcReg[a].Swizzle, c);
   338
   339                      if (field <= SWIZZLE_W)
   340                          live_components[inst->SrcReg[a].Index] |= (1U << field);
   341                  }
   342              }
   343          }
   344
   345          p->usedRegs[i] = regsUsed;
   346      }

Reported-by: Vinson Lee <vlee@vmware.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=40022
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
(cherry picked from commit 67582e6eef)
2011-10-14 17:28:45 -07:00
..
driclient
egl wayland-drm: Add copyright notice to protocol 2011-07-27 10:08:01 +02:00
gallium r300g: fix rendering with a non-zero index bias in draw_elements_immediate 2011-10-04 17:48:33 +02:00
gbm Make it possible to use gbm with c++ 2011-07-20 09:02:18 -07:00
getopt getopt: Make code more portable. 2011-01-12 16:54:21 +00:00
glsl glcpp: Add a test for #elif with an undefined macro. 2011-10-14 17:28:45 -07:00
glu sgi: Fix MSVC build. 2011-04-27 19:06:07 +01:00
glut scons: Revamp how to specify targets to build. 2010-11-01 13:30:22 +00:00
glw glw: Mark all extern symbols GLAPI to regain default visibility (#31294) 2011-06-20 12:31:01 -07:00
glx glx/dri2: Paper over errors in DRI2Connect when indirect 2011-10-02 17:59:54 +02:00
mapi glapi: Update specs to correctly list FramebufferTextureLayerARB as an alias of FramebufferTextureLayerEXT 2011-06-20 16:54:58 -07:00
mesa i915: out-of-bounds write in calc_live_regs() 2011-10-14 17:28:45 -07:00
Makefile
SConscript scons: Build glu. 2011-04-23 13:16:03 +01:00