From 6bde225b8b5791588837295b3b89ac132095a6f7 Mon Sep 17 00:00:00 2001 From: Vadim Girlin Date: Mon, 4 Jul 2011 18:30:42 +0400 Subject: r600g: fix buffer overflow check in r600_query_begin --- src/gallium/winsys/r600/drm/r600_hw_context.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/gallium/winsys/r600/drm/r600_hw_context.c b/src/gallium/winsys/r600/drm/r600_hw_context.c index 81e26f61158..633cd35f7a7 100644 --- a/src/gallium/winsys/r600/drm/r600_hw_context.c +++ b/src/gallium/winsys/r600/drm/r600_hw_context.c @@ -1725,7 +1725,7 @@ static boolean r600_query_result(struct r600_context *ctx, struct r600_query *qu void r600_query_begin(struct r600_context *ctx, struct r600_query *query) { - unsigned required_space; + unsigned required_space, required_buffer; int num_backends = r600_get_num_backends(ctx->radeon); /* query request needs 6/8 dwords for begin + 6/8 dwords for end */ @@ -1739,8 +1739,11 @@ void r600_query_begin(struct r600_context *ctx, struct r600_query *query) r600_context_flush(ctx); } + required_buffer = query->num_results + + 4 * (query->type == PIPE_QUERY_OCCLUSION_COUNTER ? ctx->max_db : 1); + /* if query buffer is full force a flush */ - if (query->num_results*4 >= query->buffer_size - 16) { + if (required_buffer*4 > query->buffer_size) { if (!(query->state & R600_QUERY_STATE_FLUSHED)) r600_context_flush(ctx); r600_query_result(ctx, query, TRUE); -- cgit v1.2.3