radeonsi: reject invalid vertex buffer indices at state creation

Reviewed-by: Nicolai Hähnle <[email protected]>

2 files changed, 6 insertions, 5 deletions

diff --git a/src/gallium/drivers/radeonsi/si_descriptors.c b/src/gallium/drivers/radeonsi/si_descriptors.c
index 0a49c877b12..56356210c2a 100644
--- a/src/gallium/drivers/radeonsi/si_descriptors.c
+++ b/src/gallium/drivers/radeonsi/si_descriptors.c
@@ -970,11 +970,6 @@ bool si_upload_vertex_buffer_descriptors(struct si_context *sctx)
 		unsigned offset;
 		uint32_t *desc = &ptr[i*4];
 
-		if (ve->vertex_buffer_index >= ARRAY_SIZE(sctx->vertex_buffer)) {
-			memset(desc, 0, 16);
-			continue;
-		}
-
 		vb = &sctx->vertex_buffer[ve->vertex_buffer_index];
 		rbuffer = (struct r600_resource*)vb->buffer;
 		if (!rbuffer) {
diff --git a/src/gallium/drivers/radeonsi/si_state.c b/src/gallium/drivers/radeonsi/si_state.c
index 4aa1cd7436d..3022260f2ff 100644
--- a/src/gallium/drivers/radeonsi/si_state.c
+++ b/src/gallium/drivers/radeonsi/si_state.c
@@ -3335,6 +3335,12 @@ static void *si_create_vertex_elements(struct pipe_context *ctx,
 		const struct util_format_channel_description *channel;
 		unsigned data_format, num_format;
 		int first_non_void;
+		unsigned vbo_index = elements[i].vertex_buffer_index;
+
+		if (vbo_index >= SI_NUM_VERTEX_BUFFERS) {
+			FREE(v);
+			return NULL;
+		}
 
 		desc = util_format_description(elements[i].src_format);
 		first_non_void = util_format_get_first_non_void_channel(elements[i].src_format);