frontend/nine: Fix buffer tracking out of bounds

Fixes a crash in a ffxi trace, which draws out of bounds.
This was previously resulting in trying to fill a buffer
resource not big enough.

cc: mesa-stable
Fixes: 380c2bf ("st/nine: Optimize dynamic systemmem buffers")

Signed-off-by: Axel Davy <davyaxel0@gmail.com>
Acked-by: David Heidelberg <david.heidelberg@collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/18021>

src/gallium/frontends/nine/buffer9.c

@@ -272,6 +272,7 @@ NineBuffer9_Lock( struct NineBuffer9 *This,
     if (!(This->base.usage & D3DUSAGE_DYNAMIC) && This->base.pool == D3DPOOL_DEFAULT)
         SizeToLock = This->size - OffsetToLock;
 
+    SizeToLock = MIN2(SizeToLock, This->size - OffsetToLock); /* Do not read or track out of the buffer */
     u_box_1d(OffsetToLock, SizeToLock, &box);
 
     if (This->base.pool != D3DPOOL_DEFAULT) {

src/gallium/frontends/nine/device9.c

@@ -2983,7 +2983,9 @@ NineTrackSystemmemDynamic( struct NineBuffer9 *This, unsigned start, unsigned wi
 {
     struct pipe_box box;
 
-    u_box_1d(start, width, &box);
+    if (start >= This->size)
+        return; /* outside bounds, nothing to do */
+    u_box_1d(start, MIN2(width, This->size-start), &box);
     u_box_union_1d(&This->managed.required_valid_region,
                    &This->managed.required_valid_region,
                    &box);