AlexIndustrial/mesa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mesa/st: Fix potential array out-of-bounds in st_bind_hw_atomic_buffers()

Browse Source 
The value of MaxAtomicBufferBindings comes from the driver
and may exceed PIPE_MAX_HW_ATOMIC_BUFFERS, causing an array
out-of-bounds issue.

Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn>
Reviewed-by: Corentin Noël <corentin.noel@collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/35730>
This commit is contained in:
Feng Jiang
2025-06-24 17:11:49 +08:00
committed by Marge Bot
parent ac6dddb850
commit 7cffd3818f
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mesa/state_tracker/st_atom_atomicbuf.c
+5 -2
View File
@@ -157,12 +157,15 @@ st_bind_hw_atomic_buffers(struct st_context *st)
{
struct pipe_shader_buffer buffers[PIPE_MAX_HW_ATOMIC_BUFFERS];
int i;
unsigned count;
if (!st->has_hw_atomics)
return;
for (i = 0; i < st->ctx->Const.MaxAtomicBufferBindings; i++)
count = MIN2(st->ctx->Const.MaxAtomicBufferBindings, PIPE_MAX_HW_ATOMIC_BUFFERS);
for (i = 0; i < count; i++)
st_binding_to_sb(&st->ctx->AtomicBufferBindings[i], &buffers[i], 1);
st->pipe->set_hw_atomic_buffers(st->pipe, 0, st->ctx->Const.MaxAtomicBufferBindings, buffers);
st->pipe->set_hw_atomic_buffers(st->pipe, 0, count, buffers);
}