From f9e11c71c7f09c7415bf81188175c0cee030356e Mon Sep 17 00:00:00 2001 From: Alyssa Rosenzweig Date: Thu, 24 Nov 2022 18:26:20 -0500 Subject: [PATCH] asahi: Fix undefined behaviour with samplers bind_sampler_states doesn't zero [nr_samplers, PIPE_MAX_SAMPLERS) so can get non-null garbage samplers leading to a use-after-free (segfault derefencing sampler) or a buffer overflow (writing samplers[] out). Fixes crashes in Xonotic. Signed-off-by: Alyssa Rosenzweig Reported-by: dcow Tested-by: dcow Part-of: --- src/gallium/drivers/asahi/agx_state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gallium/drivers/asahi/agx_state.c b/src/gallium/drivers/asahi/agx_state.c index 6b88d7ecd22..a4f803f95e6 100644 --- a/src/gallium/drivers/asahi/agx_state.c +++ b/src/gallium/drivers/asahi/agx_state.c @@ -1348,7 +1348,7 @@ agx_build_pipeline(struct agx_batch *batch, struct agx_compiled_shader *cs, enum } /* TODO: Dirty track me to save some CPU cycles and maybe improve caching */ - for (unsigned i = 0; i < PIPE_MAX_SAMPLERS; ++i) { + for (unsigned i = 0; i < nr_samplers; ++i) { struct agx_sampler_state *sampler = ctx->stage[stage].samplers[i]; if (sampler)