<html> <head> <base href="https://bugs.freedesktop.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_NEEDINFO " title="NEEDINFO - intel/decoder: out of bounds group_iter" href="https://bugs.freedesktop.org/show_bug.cgi?id=107544#c4">Comment # 4</a> on <a class="bz_bug_link bz_status_NEEDINFO " title="NEEDINFO - intel/decoder: out of bounds group_iter" href="https://bugs.freedesktop.org/show_bug.cgi?id=107544">bug 107544</a> from <a class="email" href="mailto:andrey.simiklit@gmail.com" title="asimiklit <andrey.simiklit@gmail.com>"> asimiklit</a> <pre>Created <a href="attachment.cgi?id=141069" name="attach_141069" title="simple reproducer">attachment 141069</a> <a href="attachment.cgi?id=141069&action=edit" title="simple reproducer">[details]</a> simple reproducer (In reply to Lionel Landwerlin from <a href="show_bug.cgi?id=107544#c3">comment #3</a>) > Could you attach the file that is causing the crash? > Thanks! Hi, The simple reproducer is attached. I think that my patch can help avoid some issues with new command types in "batchbuffer" in the future. But it is not enough to fix this issue. As far as I understood currently the decoder tries to determine the length of the structure BLEND_STATE based on command type. But BLEND_STATE is placed in "statebuffer" and does not have any headers just a data. We create the following structure in gen_decoder.c:387 struct gen_group *group = create_group(ctx, "", atts, ctx->group, false); previous_group->next = group;//previous_group->name is "BLEND_STATE" with the following settings: group->fixed_length is false and group->variable is true That is why we tried to determine the length based on command type. Is it expected behavior? Regards, Andrii.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the QA Contact for the bug.</li> <li>You are the assignee for the bug.</li> </ul> </body> </html>