Mesa (master): swrast: fix span clipping bug
Brian Paul
brianp at kemper.freedesktop.org
Thu May 7 15:47:45 UTC 2009
Module: Mesa
Branch: master
Commit: 6a3004b9ae58dafd1ce995df78b0f3183827a59d
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=6a3004b9ae58dafd1ce995df78b0f3183827a59d
Author: Brian Paul <brianp at vmware.com>
Date: Thu May 7 09:43:15 2009 -0600
swrast: fix span clipping bug
If a horizontal span of pixels was located at x < 0 we could sometimes
read/write outside of renderbuffer bounds.
---
src/mesa/swrast/s_span.c | 84 +++++++++++++++++++++++++++++++++++-----------
src/mesa/swrast/s_span.h | 9 ++++-
2 files changed, 71 insertions(+), 22 deletions(-)
diff --git a/src/mesa/swrast/s_span.c b/src/mesa/swrast/s_span.c
index cfff82b..fa8ca1d 100644
--- a/src/mesa/swrast/s_span.c
+++ b/src/mesa/swrast/s_span.c
@@ -1,8 +1,9 @@
/*
* Mesa 3-D graphics library
- * Version: 7.1
+ * Version: 7.5
*
- * Copyright (C) 1999-2007 Brian Paul All Rights Reserved.
+ * Copyright (C) 1999-2008 Brian Paul All Rights Reserved.
+ * Copyright (C) 2009 VMware, Inc. All Rights Reserved.
*
* Permission is hereby granted, free of charge, to any person obtaining a
* copy of this software and associated documentation files (the "Software"),
@@ -188,10 +189,10 @@ interpolate_active_attribs(GLcontext *ctx, SWspan *span, GLbitfield attrMask)
const GLfloat dv1dx = span->attrStepX[attr][1];
const GLfloat dv2dx = span->attrStepX[attr][2];
const GLfloat dv3dx = span->attrStepX[attr][3];
- GLfloat v0 = span->attrStart[attr][0];
- GLfloat v1 = span->attrStart[attr][1];
- GLfloat v2 = span->attrStart[attr][2];
- GLfloat v3 = span->attrStart[attr][3];
+ GLfloat v0 = span->attrStart[attr][0] + span->leftClip * dv0dx;
+ GLfloat v1 = span->attrStart[attr][1] + span->leftClip * dv1dx;
+ GLfloat v2 = span->attrStart[attr][2] + span->leftClip * dv2dx;
+ GLfloat v3 = span->attrStart[attr][3] + span->leftClip * dv3dx;
GLuint k;
for (k = 0; k < span->end; k++) {
const GLfloat invW = 1.0f / w;
@@ -521,10 +522,10 @@ interpolate_texcoords(GLcontext *ctx, SWspan *span)
const GLfloat drdx = span->attrStepX[attr][2];
const GLfloat dqdx = span->attrStepX[attr][3];
const GLfloat dqdy = span->attrStepY[attr][3];
- GLfloat s = span->attrStart[attr][0];
- GLfloat t = span->attrStart[attr][1];
- GLfloat r = span->attrStart[attr][2];
- GLfloat q = span->attrStart[attr][3];
+ GLfloat s = span->attrStart[attr][0] + span->leftClip * dsdx;
+ GLfloat t = span->attrStart[attr][1] + span->leftClip * dtdx;
+ GLfloat r = span->attrStart[attr][2] + span->leftClip * drdx;
+ GLfloat q = span->attrStart[attr][3] + span->leftClip * dqdx;
if (obj) {
const struct gl_texture_image *img = obj->Image[0][obj->BaseLevel];
@@ -546,7 +547,7 @@ interpolate_texcoords(GLcontext *ctx, SWspan *span)
|| ctx->ATIFragmentShader._Enabled) {
/* do perspective correction but don't divide s, t, r by q */
const GLfloat dwdx = span->attrStepX[FRAG_ATTRIB_WPOS][3];
- GLfloat w = span->attrStart[FRAG_ATTRIB_WPOS][3];
+ GLfloat w = span->attrStart[FRAG_ATTRIB_WPOS][3] + span->leftClip * dwdx;
for (i = 0; i < span->end; i++) {
const GLfloat invW = 1.0F / w;
texcoord[i][0] = s * invW;
@@ -587,7 +588,7 @@ interpolate_texcoords(GLcontext *ctx, SWspan *span)
ctx->ATIFragmentShader._Enabled) {
/* do perspective correction but don't divide s, t, r by q */
const GLfloat dwdx = span->attrStepX[FRAG_ATTRIB_WPOS][3];
- GLfloat w = span->attrStart[FRAG_ATTRIB_WPOS][3];
+ GLfloat w = span->attrStart[FRAG_ATTRIB_WPOS][3] + span->leftClip * dwdx;
for (i = 0; i < span->end; i++) {
const GLfloat invW = 1.0F / w;
texcoord[i][0] = s * invW;
@@ -660,8 +661,8 @@ interpolate_wpos(GLcontext *ctx, SWspan *span)
}
}
- w = span->attrStart[FRAG_ATTRIB_WPOS][3];
dw = span->attrStepX[FRAG_ATTRIB_WPOS][3];
+ w = span->attrStart[FRAG_ATTRIB_WPOS][3] + span->leftClip * dw;
for (i = 0; i < span->end; i++) {
wpos[i][2] = (GLfloat) span->array->z[i] * zScale;
wpos[i][3] = w;
@@ -726,6 +727,8 @@ clip_span( GLcontext *ctx, SWspan *span )
const GLint ymin = ctx->DrawBuffer->_Ymin;
const GLint ymax = ctx->DrawBuffer->_Ymax;
+ span->leftClip = 0;
+
if (span->arrayMask & SPAN_XY) {
/* arrays of x/y pixel coords */
const GLint *x = span->array->x;
@@ -753,7 +756,7 @@ clip_span( GLcontext *ctx, SWspan *span )
/* horizontal span of pixels */
const GLint x = span->x;
const GLint y = span->y;
- const GLint n = span->end;
+ GLint n = span->end;
/* Trivial rejection tests */
if (y < ymin || y >= ymax || x + n <= xmin || x >= xmax) {
@@ -761,18 +764,44 @@ clip_span( GLcontext *ctx, SWspan *span )
return GL_FALSE; /* all pixels clipped */
}
+ /* Clip to right */
+ if (x + n > xmax) {
+ ASSERT(x < xmax);
+ n = span->end = xmax - x;
+ }
+
/* Clip to the left */
if (x < xmin) {
+ const GLint leftClip = xmin - x;
+ GLuint i;
+
+ ASSERT(leftClip > 0);
ASSERT(x + n > xmin);
+
+ /* Clip 'leftClip' pixels from the left side.
+ * The span->leftClip field will be applied when we interpolate
+ * fragment attributes.
+ * For arrays of values, shift them left.
+ */
+ for (i = 0; i < FRAG_ATTRIB_MAX; i++) {
+ if (span->arrayAttribs & (1 << i)) {
+ /* shift array elements left by 'leftClip' */
+ _mesa_memcpy(span->array->attribs[i],
+ span->array->attribs[i] + leftClip,
+ (n - leftClip) * 4 * sizeof(GLfloat));
+ }
+ }
+
+ span->leftClip = leftClip;
+ span->x = xmin;
+ span->end -= leftClip;
span->writeAll = GL_FALSE;
- _mesa_bzero(span->array->mask, (xmin - x) * sizeof(GLubyte));
}
- /* Clip to right */
- if (x + n > xmax) {
- ASSERT(x < xmax);
- span->end = xmax - x;
- }
+ ASSERT(span->x >= xmin);
+ ASSERT(span->x + span->end <= xmax);
+ ASSERT(span->y >= ymin);
+ ASSERT(span->y < ymax);
return GL_TRUE; /* some pixels visible */
}
@@ -818,6 +847,12 @@ _swrast_write_index_span( GLcontext *ctx, SWspan *span)
}
}
+ if (!(span->arrayMask & SPAN_MASK)) {
+ /* post-clip sanity check */
+ assert(span->x >= 0);
+ assert(span->y >= 0);
+ }
+
/* Depth bounds test */
if (ctx->Depth.BoundsTest && fb->Visual.depthBits > 0) {
if (!_swrast_depth_bounds_test(ctx, span)) {
@@ -1284,6 +1319,7 @@ _swrast_write_rgba_span( GLcontext *ctx, SWspan *span)
#ifdef DEBUG
/* Make sure all fragments are within window bounds */
if (span->arrayMask & SPAN_XY) {
+ /* array of pixel locations */
GLuint i;
for (i = 0; i < span->end; i++) {
if (span->array->mask[i]) {
@@ -1321,6 +1357,14 @@ _swrast_write_rgba_span( GLcontext *ctx, SWspan *span)
if (!(span->arrayMask & SPAN_Z))
_swrast_span_interpolate_z(ctx, span);
+ if ((span->arrayMask & SPAN_XY) == 0) {
+ if (span->x < fb->_Xmin || span->x + span->end > fb->_Xmax ||
+ span->y < fb->_Ymin || span->y >= fb->_Ymax) {
+ printf("Bad span clipping at %d, %d\n", span->x, span->y);
+ return;
+ }
+ }
+
if (ctx->Stencil._Enabled) {
/* Combined Z/stencil tests */
if (!_swrast_stencil_and_ztest_span(ctx, span)) {
diff --git a/src/mesa/swrast/s_span.h b/src/mesa/swrast/s_span.h
index c4b47df..0eabae2 100644
--- a/src/mesa/swrast/s_span.h
+++ b/src/mesa/swrast/s_span.h
@@ -1,8 +1,9 @@
/*
* Mesa 3-D graphics library
- * Version: 6.5
+ * Version: 7.5
*
- * Copyright (C) 1999-2005 Brian Paul All Rights Reserved.
+ * Copyright (C) 1999-2008 Brian Paul All Rights Reserved.
+ * Copyright (C) 2009 VMware, Inc. All Rights Reserved.
*
* Permission is hereby granted, free of charge, to any person obtaining a
* copy of this software and associated documentation files (the "Software"),
@@ -106,6 +107,9 @@ typedef struct sw_span
/** Number of fragments in the span */
GLuint end;
+ /** for clipping left edge of spans */
+ GLuint leftClip;
+
/** This flag indicates that mask[] array is effectively filled with ones */
GLboolean writeAll;
@@ -165,6 +169,7 @@ do { \
(S).arrayMask = 0x0; \
(S).arrayAttribs = 0x0; \
(S).end = 0; \
+ (S).leftClip = 0; \
(S).facing = 0; \
(S).array = SWRAST_CONTEXT(ctx)->SpanArrays; \
} while (0)
More information about the mesa-commit
mailing list