AlexIndustrial/mesa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

radv/rra: Avoid reading past the ray history buffer

Browse Source 
The loop exit condition did not take the token size into account.

Fixes: 767f628 ("radv/rra: Dump basic ray history tokens")
Reviewed-by: Friedrich Vock <friedrich.vock@gmx.de>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27815>
This commit is contained in:
Konstantin Seurer
2024-02-27 10:30:09 +01:00
committed by Marge Bot
parent 082735750b
commit d9a1882daa
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/amd/vulkan/radv_rra.c
+4 -1
View File
@@ -1424,7 +1424,10 @@ radv_rra_dump_trace(VkQueue vk_queue, char *filename)
uint32_t history_size = MIN2(history_header->offset, device->rra_trace.ray_history_buffer_size);
uint32_t token_size;
for (uint32_t offset = sizeof(struct radv_ray_history_header); offset < history_size; offset += token_size) {
for (uint32_t offset = sizeof(struct radv_ray_history_header);; offset += token_size) {
if (offset + sizeof(struct radv_packed_end_trace_token) > history_size)
break;
struct radv_packed_end_trace_token *src = (void *)(history + offset);
token_size = src->header.hit ? sizeof(struct radv_packed_end_trace_token)
: offsetof(struct radv_packed_end_trace_token, primitive_id);