llvmpipe: fix out-of-bounds texture sampling

If we're using a wrap mode in which border color sampling is possible
it means that texcoords may be outside of the texture image bounds.
Fetching the texel may result in a segfault.

Use the 'use_border' variable to catch such texcoords and replace
the texel offset with zero (which will be in bounds).

Fixes segfault in Lightsmark demo, fd.o bug 27877.

1 files changed, 12 insertions, 0 deletions

diff --git a/src/gallium/auxiliary/gallivm/lp_bld_sample_soa.c b/src/gallium/auxiliary/gallivm/lp_bld_sample_soa.c
index 7c9c8e2d9f7..54c0ad7ce43 100644
--- a/src/gallium/auxiliary/gallivm/lp_bld_sample_soa.c
+++ b/src/gallium/auxiliary/gallivm/lp_bld_sample_soa.c
@@ -325,6 +325,18 @@ lp_build_sample_texel_soa(struct lp_build_sample_context *bld,
                                    bld->format_desc,
                                    x, y, z, y_stride, z_stride);
 
+   if (use_border) {
+      /* If we can sample the border color, it means that texcoords may
+       * lie outside the bounds of the texture image.  We need to do
+       * something to prevent reading out of bounds and causing a segfault.
+       *
+       * Simply AND the texture coords with !use_border.  This will cause
+       * coords which are out of bounds to become zero.  Zero's guaranteed
+       * to be inside the texture image.
+       */
+      offset = lp_build_andc(&bld->uint_coord_bld, offset, use_border);
+   }
+
    lp_build_fetch_rgba_soa(bld->builder,
                            bld->format_desc,
                            bld->texel_type,