diff options
| author | Li Qiang <[email protected]> | 2017-01-23 02:44:03 -0500 |
|---|---|---|
| committer | Dave Airlie <[email protected]> | 2017-02-07 14:00:04 +1000 |
| commit | 83fb63d31de51cd49a947f68393672e97b307f37 (patch) | |
| tree | ec48db63c7c2b643343b1150091e36d904fd604f | |
| parent | ce8a63de6dffd4a7bc704b63bdd48a63798a438e (diff) | |
gallium/tgsi: fix oob access in parse instruction
When parsing texture instruction, it doesn't stop if the
'cur' is ',', the loop variable 'i' will also be increased
and be used to index the 'inst.TexOffsets' array. This can lead
an oob access issue. This patch avoid this.
Reviewed-by: Dave Airlie <[email protected]>
Signed-off-by: Li Qiang <[email protected]>
| -rw-r--r-- | src/gallium/auxiliary/tgsi/tgsi_text.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/gallium/auxiliary/tgsi/tgsi_text.c b/src/gallium/auxiliary/tgsi/tgsi_text.c index 308e6b52627..4ed905036f1 100644 --- a/src/gallium/auxiliary/tgsi/tgsi_text.c +++ b/src/gallium/auxiliary/tgsi/tgsi_text.c @@ -1163,7 +1163,7 @@ parse_instruction( cur = ctx->cur; eat_opt_white( &cur ); - for (i = 0; inst.Instruction.Texture && *cur == ','; i++) { + for (i = 0; inst.Instruction.Texture && *cur == ',' && i < TGSI_FULL_MAX_TEX_OFFSETS; i++) { cur++; eat_opt_white( &cur ); ctx->cur = cur; |