From d9a1882daaabc7e274c02326b9b78eb5668614bb Mon Sep 17 00:00:00 2001 From: Konstantin Seurer Date: Tue, 27 Feb 2024 10:30:09 +0100 Subject: [PATCH] radv/rra: Avoid reading past the ray history buffer The loop exit condition did not take the token size into account. Fixes: 767f628 ("radv/rra: Dump basic ray history tokens") Reviewed-by: Friedrich Vock Part-of: --- src/amd/vulkan/radv_rra.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/amd/vulkan/radv_rra.c b/src/amd/vulkan/radv_rra.c index 3e11b06be7e..b4208180a51 100644 --- a/src/amd/vulkan/radv_rra.c +++ b/src/amd/vulkan/radv_rra.c @@ -1424,7 +1424,10 @@ radv_rra_dump_trace(VkQueue vk_queue, char *filename) uint32_t history_size = MIN2(history_header->offset, device->rra_trace.ray_history_buffer_size); uint32_t token_size; - for (uint32_t offset = sizeof(struct radv_ray_history_header); offset < history_size; offset += token_size) { + for (uint32_t offset = sizeof(struct radv_ray_history_header);; offset += token_size) { + if (offset + sizeof(struct radv_packed_end_trace_token) > history_size) + break; + struct radv_packed_end_trace_token *src = (void *)(history + offset); token_size = src->header.hit ? sizeof(struct radv_packed_end_trace_token) : offsetof(struct radv_packed_end_trace_token, primitive_id);