From faad7a8aad0133c49f9a86790b2ec8cbf06bbdd6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Se=C3=A1n=20de=20B=C3=BArca?= Date: Tue, 11 Mar 2025 15:51:30 -0700 Subject: [PATCH] rusticl/mem: don't write more supported image formats than requested clGetSupportedImageFormats will write as many supported formats as are discovered at present, regardless of the value of num_image_formats. This could result in writing out-of-bounds memory. v2: reordered commits to allow cherry-picking bugfixes Reviewed-by: Karol Herbst Cc: stable Part-of: --- src/gallium/frontends/rusticl/api/memory.rs | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/src/gallium/frontends/rusticl/api/memory.rs b/src/gallium/frontends/rusticl/api/memory.rs index 30a68d77a3f..0e3989d2d10 100644 --- a/src/gallium/frontends/rusticl/api/memory.rs +++ b/src/gallium/frontends/rusticl/api/memory.rs @@ -917,8 +917,17 @@ fn get_supported_image_formats( res.sort(); res.dedup(); + // `num_image_formats` should be the full count of supported formats, + // regardless of the value of `num_entries`. It may be null, in which case + // it is ignored. num_image_formats.write_checked(res.len() as cl_uint); - unsafe { image_formats.copy_checked(res.as_ptr(), res.len()) }; + + // `image_formats` may be null, in which case it is ignored. + let num_entries_to_write = cmp::min(res.len(), num_entries as usize); + // SAFETY: Callers are responsible for providing either a null pointer or + // one for which a write of `num_entries * size_of::()` is + // valid. The validity of reading from `res` is guaranteed by the compiler. + unsafe { image_formats.copy_checked(res.as_ptr(), num_entries_to_write) }; Ok(()) }