diff options
| author | Mark Janes <[email protected]> | 2016-02-10 13:41:27 -0800 |
|---|---|---|
| committer | Mark Janes <[email protected]> | 2016-02-10 14:43:03 -0800 |
| commit | 8179834030c85722824a2a4863e4d5c2d75f07eb (patch) | |
| tree | e2c4f9b80511a14258486ba45c982f2afebad9ea /src/compiler | |
| parent | 51c01e292c9a71958bb495d30397e82ba1a3d5d8 (diff) | |
nir/spirv: fix build_mat_subdet stack smasher
The sub-determinate implementation pattern fixed by
6a7e2904e0a2a6f8efbf739a1b3cad7e1e4ab42d has a second instance in the
same file.
With the previous algorithm, when row and j are both 3, the index
overruns the array. This only impacts the stack on 32 bit builds.
Reviewed-by: Jason Ekstrand <[email protected]>
Diffstat (limited to 'src/compiler')
| -rw-r--r-- | src/compiler/nir/spirv/vtn_glsl450.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/src/compiler/nir/spirv/vtn_glsl450.c b/src/compiler/nir/spirv/vtn_glsl450.c index 4fceffa37a6..5fb73df0566 100644 --- a/src/compiler/nir/spirv/vtn_glsl450.c +++ b/src/compiler/nir/spirv/vtn_glsl450.c @@ -121,8 +121,11 @@ build_mat_subdet(struct nir_builder *b, struct vtn_ssa_value *src, } else { /* Swizzle to get all but the specified row */ unsigned swiz[3]; - for (unsigned j = 0; j < 4; j++) - swiz[j - (j > row)] = j; + for (unsigned j = 0, k = 0; j < 3; j++, k++) { + if (k == row) + k++; /* skip column */ + swiz[j] = k; + } /* Grab all but the specified column */ nir_ssa_def *subcol[3]; |