From 8179834030c85722824a2a4863e4d5c2d75f07eb Mon Sep 17 00:00:00 2001 From: Mark Janes Date: Wed, 10 Feb 2016 13:41:27 -0800 Subject: nir/spirv: fix build_mat_subdet stack smasher The sub-determinate implementation pattern fixed by 6a7e2904e0a2a6f8efbf739a1b3cad7e1e4ab42d has a second instance in the same file. With the previous algorithm, when row and j are both 3, the index overruns the array. This only impacts the stack on 32 bit builds. Reviewed-by: Jason Ekstrand --- src/compiler/nir/spirv/vtn_glsl450.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/compiler/nir/spirv/vtn_glsl450.c b/src/compiler/nir/spirv/vtn_glsl450.c index 4fceffa37a6..5fb73df0566 100644 --- a/src/compiler/nir/spirv/vtn_glsl450.c +++ b/src/compiler/nir/spirv/vtn_glsl450.c @@ -121,8 +121,11 @@ build_mat_subdet(struct nir_builder *b, struct vtn_ssa_value *src, } else { /* Swizzle to get all but the specified row */ unsigned swiz[3]; - for (unsigned j = 0; j < 4; j++) - swiz[j - (j > row)] = j; + for (unsigned j = 0, k = 0; j < 3; j++, k++) { + if (k == row) + k++; /* skip column */ + swiz[j] = k; + } /* Grab all but the specified column */ nir_ssa_def *subcol[3]; -- cgit v1.2.3