Mesa (master): glsl: Fix crash due to negative array index
Anuj Phogat
aphogat at kemper.freedesktop.org
Wed Oct 22 23:21:23 UTC 2014
Module: Mesa
Branch: master
Commit: 6f0089e92e9a3b096b978bb09a87db6a38acb7b2
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=6f0089e92e9a3b096b978bb09a87db6a38acb7b2
Author: Anuj Phogat <anuj.phogat at gmail.com>
Date: Thu Sep 18 16:30:31 2014 -0700
glsl: Fix crash due to negative array index
Currently Mesa crashes with a shader like this:
[fragmnet shader]
float[5] array;
int idx = -2;
void main()
{
gl_FragColor = vec4(0.0, 1.0, 0.0, array[idx]);
}
Cc: <mesa-stable at lists.freedesktop.org>
Signed-off-by: Anuj Phogat <anuj.phogat at gmail.com>
Reviewed-by: Chris Forbes <chrisf at ijw.co.nz>
---
src/glsl/opt_array_splitting.cpp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/glsl/opt_array_splitting.cpp b/src/glsl/opt_array_splitting.cpp
index ebb076b..9e73f3c 100644
--- a/src/glsl/opt_array_splitting.cpp
+++ b/src/glsl/opt_array_splitting.cpp
@@ -295,7 +295,7 @@ ir_array_splitting_visitor::split_deref(ir_dereference **deref)
ir_constant *constant = deref_array->array_index->as_constant();
assert(constant);
- if (constant->value.i[0] < (int)entry->size) {
+ if (constant->value.i[0] >= 0 && constant->value.i[0] < (int)entry->size) {
*deref = new(entry->mem_ctx)
ir_dereference_variable(entry->components[constant->value.i[0]]);
} else {
More information about the mesa-commit
mailing list