AlexIndustrial/mesa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

draw: Prevent index buffer overflow.

Browse Source 
This prevents segfaults running wgf11draw DrawMethod=DrawIndexed tests
cases.

This change is not, however, sufficient to pass all tests.  That is,
there must remain code paths where indices read beyond the end of the
index buffer do not return zero index.

Reviewed-by: Roland Scheidegger <sroland@vmware.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/19648>
This commit is contained in:
Jose Fonseca
2022-11-09 09:22:06 +00:00
committed by Marge Bot
parent 2c44597181
commit 6bb5aceb28
1 changed files with 16 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/gallium/auxiliary/draw/draw_pt.c
+16 -14
View File
@@ -365,23 +365,25 @@ prim_restart_loop(struct draw_context *draw,
const unsigned MAX_LOOP_IDX = 0xffffffff;
for (unsigned j = 0; j < draw_info->count; j++) {
unsigned restart_idx = 0;
unsigned index = 0;
unsigned i = draw_overflow_uadd(draw_info->start, j, MAX_LOOP_IDX);
switch (draw->pt.user.eltSize) {
case 1:
restart_idx = ((const uint8_t*)elements)[i];
break;
case 2:
restart_idx = ((const uint16_t*)elements)[i];
break;
case 4:
restart_idx = ((const uint32_t*)elements)[i];
break;
default:
assert(0 && "bad eltSize in draw_arrays()");
if (i < elt_max) {
switch (draw->pt.user.eltSize) {
case 1:
index = ((const uint8_t*)elements)[i];
break;
case 2:
index = ((const uint16_t*)elements)[i];
break;
case 4:
index = ((const uint32_t*)elements)[i];
break;
default:
assert(0 && "bad eltSize in draw_arrays()");
}
}
if (i < elt_max && restart_idx == info->restart_index) {
if (index == info->restart_index) {
if (cur.count > 0) {
/* draw elts up to prev pos */
draw_pt_arrays(draw, info->mode, info->index_bias_varies, &cur, 1);