aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMarek Olšák <[email protected]>2013-05-02 05:08:08 +0200
committerMarek Olšák <[email protected]>2013-05-10 03:23:31 +0200
commitda33f9b919039442e9ab51f9b1d1c83a73607133 (patch)
tree9fbe193960cc4605b7ae57d21c1d954770525b46
parent121c2c898368ec8de54d230b7db0316695e63a83 (diff)
r600g: increase array size for shader inputs and outputs
and add assertions to prevent buffer overflow. This fixes corruption of the r600_shader struct. NOTE: This is a candidate for the stable branches.
-rw-r--r--src/gallium/drivers/r600/r600_shader.c2
-rw-r--r--src/gallium/drivers/r600/r600_shader.h4
2 files changed, 4 insertions, 2 deletions
diff --git a/src/gallium/drivers/r600/r600_shader.c b/src/gallium/drivers/r600/r600_shader.c
index 78266c07cea..4416ef0fde2 100644
--- a/src/gallium/drivers/r600/r600_shader.c
+++ b/src/gallium/drivers/r600/r600_shader.c
@@ -571,6 +571,7 @@ static int tgsi_declaration(struct r600_shader_ctx *ctx)
switch (d->Declaration.File) {
case TGSI_FILE_INPUT:
i = ctx->shader->ninput;
+ assert(i < Elements(ctx->shader->input));
ctx->shader->ninput += count;
ctx->shader->input[i].name = d->Semantic.Name;
ctx->shader->input[i].sid = d->Semantic.Index;
@@ -602,6 +603,7 @@ static int tgsi_declaration(struct r600_shader_ctx *ctx)
break;
case TGSI_FILE_OUTPUT:
i = ctx->shader->noutput++;
+ assert(i < Elements(ctx->shader->output));
ctx->shader->output[i].name = d->Semantic.Name;
ctx->shader->output[i].sid = d->Semantic.Index;
ctx->shader->output[i].gpr = ctx->file_offset[TGSI_FILE_OUTPUT] + d->Range.First;
diff --git a/src/gallium/drivers/r600/r600_shader.h b/src/gallium/drivers/r600/r600_shader.h
index 411667ae89e..d989ce43649 100644
--- a/src/gallium/drivers/r600/r600_shader.h
+++ b/src/gallium/drivers/r600/r600_shader.h
@@ -45,8 +45,8 @@ struct r600_shader {
unsigned ninput;
unsigned noutput;
unsigned nlds;
- struct r600_shader_io input[32];
- struct r600_shader_io output[32];
+ struct r600_shader_io input[40];
+ struct r600_shader_io output[40];
boolean uses_kill;
boolean fs_write_all;
boolean two_side;