From e5124e83ba1f9a7c86a3b1b8d38e7c71cd481f88 Mon Sep 17 00:00:00 2001 From: Axel Davy Date: Thu, 11 Aug 2022 22:04:57 +0200 Subject: [PATCH] frontend/nine: Fix buffer tracking out of bounds Fixes a crash in a ffxi trace, which draws out of bounds. This was previously resulting in trying to fill a buffer resource not big enough. cc: mesa-stable Fixes: 380c2bf ("st/nine: Optimize dynamic systemmem buffers") Signed-off-by: Axel Davy Acked-by: David Heidelberg Part-of: --- src/gallium/frontends/nine/buffer9.c | 1 + src/gallium/frontends/nine/device9.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/src/gallium/frontends/nine/buffer9.c b/src/gallium/frontends/nine/buffer9.c index cc6369ff389..84eb8bbb0e2 100644 --- a/src/gallium/frontends/nine/buffer9.c +++ b/src/gallium/frontends/nine/buffer9.c @@ -272,6 +272,7 @@ NineBuffer9_Lock( struct NineBuffer9 *This, if (!(This->base.usage & D3DUSAGE_DYNAMIC) && This->base.pool == D3DPOOL_DEFAULT) SizeToLock = This->size - OffsetToLock; + SizeToLock = MIN2(SizeToLock, This->size - OffsetToLock); /* Do not read or track out of the buffer */ u_box_1d(OffsetToLock, SizeToLock, &box); if (This->base.pool != D3DPOOL_DEFAULT) { diff --git a/src/gallium/frontends/nine/device9.c b/src/gallium/frontends/nine/device9.c index 9986aea0b16..236f426ff28 100644 --- a/src/gallium/frontends/nine/device9.c +++ b/src/gallium/frontends/nine/device9.c @@ -2983,7 +2983,9 @@ NineTrackSystemmemDynamic( struct NineBuffer9 *This, unsigned start, unsigned wi { struct pipe_box box; - u_box_1d(start, width, &box); + if (start >= This->size) + return; /* outside bounds, nothing to do */ + u_box_1d(start, MIN2(width, This->size-start), &box); u_box_union_1d(&This->managed.required_valid_region, &This->managed.required_valid_region, &box);