svga: check that we don't exceed temp register limit

And assert on the register index in dst_register().  The dest can
only be an output or temp reg and there's more of the later.

Reviewed-by: Jose Fonseca <[email protected]>

2 files changed, 6 insertions, 0 deletions

diff --git a/src/gallium/drivers/svga/svga_tgsi.c b/src/gallium/drivers/svga/svga_tgsi.c
index 2be6f05e009..02ce59f3931 100644
--- a/src/gallium/drivers/svga/svga_tgsi.c
+++ b/src/gallium/drivers/svga/svga_tgsi.c
@@ -290,6 +290,10 @@ svga_tgsi_translate( const struct svga_shader *shader,
    emit.nr_hw_float_const = (emit.imm_start + emit.info.file_max[TGSI_FILE_IMMEDIATE] + 1);
 
    emit.nr_hw_temp = emit.info.file_max[TGSI_FILE_TEMPORARY] + 1;
+   
+   if (emit.nr_hw_temp >= SVGA3D_TEMPREG_MAX)
+      goto fail;
+
    emit.in_main_func = TRUE;
 
    if (!svga_shader_emit_header( &emit ))
diff --git a/src/gallium/drivers/svga/svga_tgsi_emit.h b/src/gallium/drivers/svga/svga_tgsi_emit.h
index 3f458eb09cf..1769d62570d 100644
--- a/src/gallium/drivers/svga/svga_tgsi_emit.h
+++ b/src/gallium/drivers/svga/svga_tgsi_emit.h
@@ -266,6 +266,8 @@ dst_register( unsigned file,
    assert(number < (1 << 11));
    assert(file <= SVGA3DREG_PREDICATE);
 
+   assert(number < SVGA3D_TEMPREG_MAX);
+
    dest.value = 0;
    dest.num = number;
    dest.type_upper = file >> 3;