From f0465ced7f9924d0be8e219ed0afe907994bd516 Mon Sep 17 00:00:00 2001
From: Rob Clark <rob.clark@oss.qualcomm.com>
Date: Sat, 22 Nov 2025 09:02:23 -0800
Subject: [PATCH] freedreno/a6xx: Fix UB in convert_color()

Swizzle can include PIPE_SWIZZLE_0/_1 (4 and 5) which result in indexing
beyond the channel array.

Reported-by: Danylo Piliaiev <dpiliaiev@igalia.com>
Fixes: 76e350671f3b ("freedreno/a6xx: Sysmem clear fixes")
Signed-off-by: Rob Clark <rob.clark@oss.qualcomm.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/38593>
---
 src/gallium/drivers/freedreno/a6xx/fd6_blitter.cc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/gallium/drivers/freedreno/a6xx/fd6_blitter.cc b/src/gallium/drivers/freedreno/a6xx/fd6_blitter.cc
index 3c5236832e8..e4b886bc0d4 100644
--- a/src/gallium/drivers/freedreno/a6xx/fd6_blitter.cc
+++ b/src/gallium/drivers/freedreno/a6xx/fd6_blitter.cc
@@ -867,6 +867,9 @@ convert_color(enum pipe_format format, union pipe_color_union *pcolor)
    for (unsigned i = 0; i < 4; i++) {
       unsigned channel = desc->swizzle[i];
 
+      if (channel >= 4) /* PIPE_SWIZZLE_0/_1 */
+         continue;
+
       if (desc->channel[channel].normalized)
          continue;