diff options
author | Eric Anholt <[email protected]> | 2013-01-10 17:48:16 -0800 |
---|---|---|
committer | Eric Anholt <[email protected]> | 2013-01-18 12:48:27 -0800 |
commit | 4533a38fa8bb8ad24661adc2b67571546249a028 (patch) | |
tree | d879f131ec282d91d71485e82220e495310f35a2 /src | |
parent | 5e529d708a99ddc55201046995aea6648ab3d65a (diff) |
mesa: Fix out of bounds writes when uncompressing non-block-aligned ETC1.
Fixes a crash in GLB2.1 offscreen on the glthread branch.
Reviewed-by: Kenneth Graunke <[email protected]>
Diffstat (limited to 'src')
-rw-r--r-- | src/mesa/main/texcompress_etc_tmp.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/mesa/main/texcompress_etc_tmp.h b/src/mesa/main/texcompress_etc_tmp.h index 8bbb2cde83e..5497566324f 100644 --- a/src/mesa/main/texcompress_etc_tmp.h +++ b/src/mesa/main/texcompress_etc_tmp.h @@ -153,9 +153,9 @@ etc1_unpack_rgba8888(uint8_t *dst_row, for (x = 0; x < width; x+= bw) { etc1_parse_block(&block, src); - for (j = 0; j < bh; j++) { + for (j = 0; j < MIN2(bh, height - y); j++) { uint8_t *dst = dst_row + (y + j) * dst_stride + x * comps; - for (i = 0; i < bw; i++) { + for (i = 0; i < MIN2(bw, width - x); i++) { etc1_fetch_texel(&block, i, j, dst); dst[3] = 255; dst += comps; |