diff options
| author | Bartosz Tomczyk <[email protected]> | 2017-02-08 17:16:13 +0100 |
|---|---|---|
| committer | Marek Olšák <[email protected]> | 2017-03-20 17:32:53 +0100 |
| commit | f4b23589da8ad395b6d5bc968502d8128a8bd8c5 (patch) | |
| tree | 3c6ff91187a860a682267b4b6713723a138d30c0 /src/gallium/drivers/r600/r600_asm.h | |
| parent | f9190f3e655c530f049e40ee2c47384deea2f874 (diff) | |
r600g: Fix out of bounds access
fc_sp variable should indicate number of elements in
fc_stack array, but fc_sp was increased at beginning of fc_pushlevel
function. It leads to situation where idx=0 was never used, and last
32 element was stored outside fs_stack array.
Signed-off-by: Marek Olšák <[email protected]>
Diffstat (limited to 'src/gallium/drivers/r600/r600_asm.h')
| -rw-r--r-- | src/gallium/drivers/r600/r600_asm.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/gallium/drivers/r600/r600_asm.h b/src/gallium/drivers/r600/r600_asm.h index 1629399d8fe..b12913d4374 100644 --- a/src/gallium/drivers/r600/r600_asm.h +++ b/src/gallium/drivers/r600/r600_asm.h @@ -25,6 +25,7 @@ #include "r600_pipe.h" #include "r600_isa.h" +#include "tgsi/tgsi_exec.h" struct r600_bytecode_alu_src { unsigned sel; @@ -238,7 +239,7 @@ struct r600_bytecode { unsigned force_add_cf; uint32_t *bytecode; uint32_t fc_sp; - struct r600_cf_stack_entry fc_stack[32]; + struct r600_cf_stack_entry fc_stack[TGSI_EXEC_MAX_NESTING]; struct r600_stack_info stack; unsigned ar_loaded; unsigned ar_reg; |