From 41bb73baf6d52c3cc900c1f48d1e3f5235135ec5 Mon Sep 17 00:00:00 2001 From: Karol Herbst Date: Sun, 7 Jul 2024 20:14:31 +0200 Subject: [PATCH] rusticl/buffer: harden bound checks against overflows Fixes: 20c90fed5a0 ("rusticl: added") Part-of: --- src/gallium/frontends/rusticl/api/memory.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/gallium/frontends/rusticl/api/memory.rs b/src/gallium/frontends/rusticl/api/memory.rs index 704fb72a412..949e6c606c5 100644 --- a/src/gallium/frontends/rusticl/api/memory.rs +++ b/src/gallium/frontends/rusticl/api/memory.rs @@ -353,7 +353,7 @@ fn create_sub_buffer( // CL_INVALID_VALUE if the region specified by the cl_buffer_region structure passed in // buffer_create_info is out of bounds in buffer. - if region.origin + region.size > b.size { + if region.origin >= b.size || region.size > b.size - region.origin { return Err(CL_INVALID_VALUE); } @@ -1670,7 +1670,7 @@ fn enqueue_map_buffer( // CL_INVALID_VALUE if region being mapped given by (offset, size) is out of bounds or if size // is 0 - if offset + size > b.size || size == 0 { + if offset >= b.size || size > b.size - offset || size == 0 { return Err(CL_INVALID_VALUE); }