From d4a54d4f9250f1a925340bec63c906751f8d0895 Mon Sep 17 00:00:00 2001 From: Paulo Zanoni Date: Wed, 11 Dec 2024 15:57:25 -0800 Subject: [PATCH] brw: don't read past the end of old_src buffer in resize_sources() In this case, num_sources is bigger than this->sources, so if we loop up to num_sources (instead of this->sources) we'll end up reading past the end of old_src[]. Only copy up to what we originally had. This was found by code inspection, I'm not aware of any applications failing due to the lack of this patch. Fixes: d9e737212d5e ("intel/brw: Add a src array for the common case in fs_inst") Reviewed-by: Ian Romanick Reviewed-by: Caio Oliveira Signed-off-by: Paulo Zanoni Part-of: --- src/intel/compiler/brw_fs.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/intel/compiler/brw_fs.cpp b/src/intel/compiler/brw_fs.cpp index d11280f5802..c03071f9c6d 100644 --- a/src/intel/compiler/brw_fs.cpp +++ b/src/intel/compiler/brw_fs.cpp @@ -188,7 +188,7 @@ fs_inst::resize_sources(uint8_t num_sources) } else { new_src = new brw_reg[num_sources]; - for (unsigned i = 0; i < num_sources; i++) + for (unsigned i = 0; i < this->sources; i++) new_src[i] = old_src[i]; }