[Bug 32277] New: overflow in calculate_miptree_layout_r300

bugzilla-daemon at freedesktop.org bugzilla-daemon at freedesktop.org
Thu Dec 9 14:10:15 PST 2010


           Summary: overflow in calculate_miptree_layout_r300
           Product: Mesa
           Version: git
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: major
          Priority: medium
         Component: Drivers/DRI/R600
        AssignedTo: dri-devel at lists.freedesktop.org
        ReportedBy: prahal at yahoo.com

Created an attachment (id=40964)
 View: https://bugs.freedesktop.org/attachment.cgi?id=40964
 Review: https://bugs.freedesktop.org/review?bug=32277&attachment=40964

Fix for the levels array overflow

extremetuxracer 0.5 beta2 shows up a bug in r600c. 

The levels array in radeon_mipmap_tree structure is defined with a size of
RADEON_MIPTREE_MAX_TEXTURE (ie 13). Though in radeon_try_alloc_miptree the size
of numLevels can overflow this size.
Then in calculate_miptree_layout_r300 the loop write out of the array.
Which leads to calloc failure in bo_open from radeon_gem_bo due to corrupted

This patch fixes this by setting the numLevels max to

Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

More information about the dri-devel mailing list