diff options
| author | Alyssa Rosenzweig <[email protected]> | 2019-08-21 09:02:40 -0700 |
|---|---|---|
| committer | Alyssa Rosenzweig <[email protected]> | 2019-08-21 10:38:31 -0700 |
| commit | cda0ec67e6a615c10ac75e7345c8982637526d8c (patch) | |
| tree | f7b90bb190dcfd5034d4f0b158e55c3a3144a0b3 /src/panfrost | |
| parent | 9ce45ac808e34bced2df346057beb8ab10313a87 (diff) | |
pan/bifrost: Avoid buffer overflow in disassembler
This path shouldn't be possible for in-spec shaders, but let's be
defensive. (Because security, right? Mostly because Coverity.)
Signed-off-by: Alyssa Rosenzweig <[email protected]>
Diffstat (limited to 'src/panfrost')
| -rw-r--r-- | src/panfrost/bifrost/disassemble.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/panfrost/bifrost/disassemble.c b/src/panfrost/bifrost/disassemble.c index c7e131d5d5b..19592e21b41 100644 --- a/src/panfrost/bifrost/disassemble.c +++ b/src/panfrost/bifrost/disassemble.c @@ -2177,7 +2177,7 @@ bool dump_clause(uint32_t *words, unsigned *size, unsigned offset, bool verbose) // share a buffer in the decoder, but we only care about // the position in the constant stream; the total number of // instructions is redundant. - unsigned const_idx = 7; + unsigned const_idx = 0; switch (pos) { case 0: case 1: @@ -2205,9 +2205,12 @@ bool dump_clause(uint32_t *words, unsigned *size, unsigned offset, bool verbose) break; default: printf("# unknown pos 0x%x\n", pos); + break; } + if (num_consts < const_idx + 2) num_consts = const_idx + 2; + consts[const_idx] = const0; consts[const_idx + 1] = const1; done = stop; |