diff options
| author | Ilia Mirkin <[email protected]> | 2016-10-19 00:05:26 -0400 |
|---|---|---|
| committer | Emil Velikov <[email protected]> | 2016-10-24 08:59:57 +0100 |
| commit | 05b89cf40e1f1c2a31fac1aed389764a9b1141b0 (patch) | |
| tree | 8ea463c571d2e723ee9868e473e71888460f6762 /src | |
| parent | 4768b7353ff47eb6d80093b0c6f5e35747365411 (diff) | |
nv50,nvc0: avoid reading out of bounds when getting bogus so info
The state tracker tries to attach the info to the wrong shader. This is
easy enough to protect against.
Signed-off-by: Ilia Mirkin <[email protected]>
Reviewed-by: Samuel Pitoiset <[email protected]>
Cc: 12.0 13.0 <[email protected]>
(cherry picked from commit 313fba5ee1de9416930e45da8aff63a24763940b)
Diffstat (limited to 'src')
| -rw-r--r-- | src/gallium/drivers/nouveau/nv50/nv50_program.c | 3 | ||||
| -rw-r--r-- | src/gallium/drivers/nouveau/nvc0/nvc0_program.c | 7 |
2 files changed, 8 insertions, 2 deletions
diff --git a/src/gallium/drivers/nouveau/nv50/nv50_program.c b/src/gallium/drivers/nouveau/nv50/nv50_program.c index 2b66877c679..ea5febdf3ae 100644 --- a/src/gallium/drivers/nouveau/nv50/nv50_program.c +++ b/src/gallium/drivers/nouveau/nv50/nv50_program.c @@ -307,6 +307,9 @@ nv50_program_create_strmout_state(const struct nv50_ir_prog_info *info, const unsigned r = pso->output[i].register_index; b = pso->output[i].output_buffer; + if (r >= info->numOutputs) + continue; + for (c = 0; c < pso->output[i].num_components; ++c) so->map[base[b] + p + c] = info->out[r].slot[s + c]; } diff --git a/src/gallium/drivers/nouveau/nvc0/nvc0_program.c b/src/gallium/drivers/nouveau/nvc0/nvc0_program.c index f52cbd29819..a4a164f15f8 100644 --- a/src/gallium/drivers/nouveau/nvc0/nvc0_program.c +++ b/src/gallium/drivers/nouveau/nvc0/nvc0_program.c @@ -509,11 +509,14 @@ nvc0_program_create_tfb_state(const struct nv50_ir_prog_info *info, for (i = 0; i < pso->num_outputs; ++i) { unsigned s = pso->output[i].start_component; unsigned p = pso->output[i].dst_offset; + const unsigned r = pso->output[i].register_index; b = pso->output[i].output_buffer; + if (r >= info->numOutputs) + continue; + for (c = 0; c < pso->output[i].num_components; ++c) - tfb->varying_index[b][p++] = - info->out[pso->output[i].register_index].slot[s + c]; + tfb->varying_index[b][p++] = info->out[r].slot[s + c]; tfb->varying_count[b] = MAX2(tfb->varying_count[b], p); tfb->stream[b] = pso->output[i].stream; |