From 7cffd3818f60d3487c05f43eab51f0863ae0ab73 Mon Sep 17 00:00:00 2001 From: Feng Jiang Date: Tue, 24 Jun 2025 17:11:49 +0800 Subject: [PATCH] mesa/st: Fix potential array out-of-bounds in st_bind_hw_atomic_buffers() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The value of MaxAtomicBufferBindings comes from the driver and may exceed PIPE_MAX_HW_ATOMIC_BUFFERS, causing an array out-of-bounds issue. Signed-off-by: Feng Jiang Reviewed-by: Corentin Noël Part-of: --- src/mesa/state_tracker/st_atom_atomicbuf.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/mesa/state_tracker/st_atom_atomicbuf.c b/src/mesa/state_tracker/st_atom_atomicbuf.c index b0f963024a9..d80344484b9 100644 --- a/src/mesa/state_tracker/st_atom_atomicbuf.c +++ b/src/mesa/state_tracker/st_atom_atomicbuf.c @@ -157,12 +157,15 @@ st_bind_hw_atomic_buffers(struct st_context *st) { struct pipe_shader_buffer buffers[PIPE_MAX_HW_ATOMIC_BUFFERS]; int i; + unsigned count; if (!st->has_hw_atomics) return; - for (i = 0; i < st->ctx->Const.MaxAtomicBufferBindings; i++) + count = MIN2(st->ctx->Const.MaxAtomicBufferBindings, PIPE_MAX_HW_ATOMIC_BUFFERS); + + for (i = 0; i < count; i++) st_binding_to_sb(&st->ctx->AtomicBufferBindings[i], &buffers[i], 1); - st->pipe->set_hw_atomic_buffers(st->pipe, 0, st->ctx->Const.MaxAtomicBufferBindings, buffers); + st->pipe->set_hw_atomic_buffers(st->pipe, 0, count, buffers); }