draw: don't crash on vertex buffer overflow

We would crash when stride was bigger than the size of the buffer.
The correct behavior is to just fetch zero's in this case.
Unfortunatly with user_buffer's there's no way to validate the size
because currently we're just not getting it. Adjust the draw interface
to pass the size along the mapped buffer, which works perfectly
for buffer backed vertex_buffers and, in future, it will allow
us to plumb user_buffer sizes through the same interface.

Signed-off-by: Zack Rusin <[email protected]>
Reviewed-by: José Fonseca <[email protected]>
Reviewed-by: Roland Scheidegger <[email protected]>

6 files changed, 15 insertions, 11 deletions

diff --git a/src/gallium/drivers/i915/i915_context.c b/src/gallium/drivers/i915/i915_context.c
index 0ee6c0eb89d..90427dca963 100644
--- a/src/gallium/drivers/i915/i915_context.c
+++ b/src/gallium/drivers/i915/i915_context.c
@@ -71,7 +71,7 @@ i915_draw_vbo(struct pipe_context *pipe, const struct pipe_draw_info *info)
       const void *buf = i915->vertex_buffers[i].user_buffer;
       if (!buf)
             buf = i915_buffer(i915->vertex_buffers[i].buffer)->data;
-      draw_set_mapped_vertex_buffer(draw, i, buf);
+      draw_set_mapped_vertex_buffer(draw, i, buf, ~0);
    }
 
    /*
@@ -106,7 +106,7 @@ i915_draw_vbo(struct pipe_context *pipe, const struct pipe_draw_info *info)
     * unmap vertex/index buffers
     */
    for (i = 0; i < i915->nr_vertex_buffers; i++) {
-      draw_set_mapped_vertex_buffer(i915->draw, i, NULL);
+      draw_set_mapped_vertex_buffer(i915->draw, i, NULL, 0);
    }
    if (mapped_indices)
       draw_set_indexes(draw, NULL, 0);
diff --git a/src/gallium/drivers/llvmpipe/lp_draw_arrays.c b/src/gallium/drivers/llvmpipe/lp_draw_arrays.c
index fc947b110d0..63c22c31304 100644
--- a/src/gallium/drivers/llvmpipe/lp_draw_arrays.c
+++ b/src/gallium/drivers/llvmpipe/lp_draw_arrays.c
@@ -68,13 +68,15 @@ llvmpipe_draw_vbo(struct pipe_context *pipe, const struct pipe_draw_info *info)
     */
    for (i = 0; i < lp->num_vertex_buffers; i++) {
       const void *buf = lp->vertex_buffer[i].user_buffer;
+      size_t size = ~0;
       if (!buf) {
          if (!lp->vertex_buffer[i].buffer) {
             continue;
          }
          buf = llvmpipe_resource_data(lp->vertex_buffer[i].buffer);
+         size = lp->vertex_buffer[i].buffer->width0;
       }
-      draw_set_mapped_vertex_buffer(draw, i, buf);
+      draw_set_mapped_vertex_buffer(draw, i, buf, size);
    }
 
    /* Map index buffer, if present */
@@ -121,7 +123,7 @@ llvmpipe_draw_vbo(struct pipe_context *pipe, const struct pipe_draw_info *info)
     * unmap vertex/index buffers
     */
    for (i = 0; i < lp->num_vertex_buffers; i++) {
-      draw_set_mapped_vertex_buffer(draw, i, NULL);
+      draw_set_mapped_vertex_buffer(draw, i, NULL, 0);
    }
    if (mapped_indices) {
       draw_set_indexes(draw, NULL, 0);
diff --git a/src/gallium/drivers/nv30/nv30_draw.c b/src/gallium/drivers/nv30/nv30_draw.c
index 4dd0df3c21f..92185c922c2 100644
--- a/src/gallium/drivers/nv30/nv30_draw.c
+++ b/src/gallium/drivers/nv30/nv30_draw.c
@@ -412,7 +412,7 @@ nv30_render_vbo(struct pipe_context *pipe, const struct pipe_draw_info *info)
                                   PIPE_TRANSFER_UNSYNCHRONIZED |
                                   PIPE_TRANSFER_READ, &transfer[i]);
       }
-      draw_set_mapped_vertex_buffer(draw, i, map);
+      draw_set_mapped_vertex_buffer(draw, i, map, ~0);
    }
 
    if (info->indexed) {
diff --git a/src/gallium/drivers/r300/r300_state.c b/src/gallium/drivers/r300/r300_state.c
index 2de0fd6b7f9..b3e25e1ad0f 100644
--- a/src/gallium/drivers/r300/r300_state.c
+++ b/src/gallium/drivers/r300/r300_state.c
@@ -1821,10 +1821,10 @@ static void r300_set_vertex_buffers_swtcl(struct pipe_context* pipe,
     for (i = 0; i < count; i++) {
         if (buffers[i].user_buffer) {
             draw_set_mapped_vertex_buffer(r300->draw, start_slot + i,
-                                          buffers[i].user_buffer);
+                                          buffers[i].user_buffer, ~0);
         } else if (buffers[i].buffer) {
             draw_set_mapped_vertex_buffer(r300->draw, start_slot + i,
-                r300_resource(buffers[i].buffer)->malloced_buffer);
+                                          r300_resource(buffers[i].buffer)->malloced_buffer, ~0);
         }
     }
 }
diff --git a/src/gallium/drivers/softpipe/sp_draw_arrays.c b/src/gallium/drivers/softpipe/sp_draw_arrays.c
index 0eb9c5024df..839fd220500 100644
--- a/src/gallium/drivers/softpipe/sp_draw_arrays.c
+++ b/src/gallium/drivers/softpipe/sp_draw_arrays.c
@@ -76,13 +76,15 @@ softpipe_draw_vbo(struct pipe_context *pipe,
    /* Map vertex buffers */
    for (i = 0; i < sp->num_vertex_buffers; i++) {
       const void *buf = sp->vertex_buffer[i].user_buffer;
+      size_t size = ~0;
       if (!buf) {
          if (!sp->vertex_buffer[i].buffer) {
             continue;
          }
          buf = softpipe_resource(sp->vertex_buffer[i].buffer)->data;
+         size = sp->vertex_buffer[i].buffer->width0;
       }
-      draw_set_mapped_vertex_buffer(draw, i, buf);
+      draw_set_mapped_vertex_buffer(draw, i, buf, size);
    }
 
    /* Map index buffer, if present */
@@ -120,7 +122,7 @@ softpipe_draw_vbo(struct pipe_context *pipe,
 
    /* unmap vertex/index buffers - will cause draw module to flush */
    for (i = 0; i < sp->num_vertex_buffers; i++) {
-      draw_set_mapped_vertex_buffer(draw, i, NULL);
+      draw_set_mapped_vertex_buffer(draw, i, NULL, 0);
    }
    if (mapped_indices) {
       draw_set_indexes(draw, NULL, 0);
diff --git a/src/gallium/drivers/svga/svga_swtnl_draw.c b/src/gallium/drivers/svga/svga_swtnl_draw.c
index bb57f6f30f8..850575c14b9 100644
--- a/src/gallium/drivers/svga/svga_swtnl_draw.c
+++ b/src/gallium/drivers/svga/svga_swtnl_draw.c
@@ -72,7 +72,7 @@ svga_swtnl_draw_vbo(struct svga_context *svga,
                                PIPE_TRANSFER_READ,
                                &vb_transfer[i]);
 
-         draw_set_mapped_vertex_buffer(draw, i, map);
+         draw_set_mapped_vertex_buffer(draw, i, map, ~0);
       }
    }
 
@@ -112,7 +112,7 @@ svga_swtnl_draw_vbo(struct svga_context *svga,
    for (i = 0; i < svga->curr.num_vertex_buffers; i++) {
       if (svga->curr.vb[i].buffer) {
          pipe_buffer_unmap(&svga->pipe, vb_transfer[i]);
-         draw_set_mapped_vertex_buffer(draw, i, NULL);
+         draw_set_mapped_vertex_buffer(draw, i, NULL, 0);
       }
    }