Mesa (master): llvmpipe: clamp scissors to be between 0 and max

[Zack Rusin]

Module: Mesa
Branch: master
Commit: c88ce3480c715ab40f4d488c86c90213b1472613
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=c88ce3480c715ab40f4d488c86c90213b1472613

Author: Zack Rusin <zackr at vmware.com>
Date:   Sat May 25 01:04:17 2013 -0400

llvmpipe: clamp scissors to be between 0 and max

We need to clamp to make sure invalid shader doesn't crash our
driver. The spec says to return 0-th index for everything that's
out of bounds.

Signed-off-by: Zack Rusin <zackr at vmware.com>
Reviewed-by: José Fonseca<jfonseca at vmware.com>
Reviewed-by: Brian Paul <brianp at vmware.com>

---

 src/gallium/drivers/llvmpipe/lp_setup.h       |    6 ++++++
 src/gallium/drivers/llvmpipe/lp_setup_line.c  |    2 +-
 src/gallium/drivers/llvmpipe/lp_setup_point.c |    2 +-
 src/gallium/drivers/llvmpipe/lp_setup_tri.c   |    2 +-
 src/gallium/drivers/llvmpipe/lp_state_clip.c  |    4 ++++
 5 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/gallium/drivers/llvmpipe/lp_setup.h b/src/gallium/drivers/llvmpipe/lp_setup.h
index 1f55aa4..712ed14 100644
--- a/src/gallium/drivers/llvmpipe/lp_setup.h
+++ b/src/gallium/drivers/llvmpipe/lp_setup.h
@@ -154,4 +154,10 @@ void
 lp_setup_end_query(struct lp_setup_context *setup,
                    struct llvmpipe_query *pq);
 
+static INLINE unsigned
+lp_clamp_scissor_idx(int idx)
+{
+   return (PIPE_MAX_VIEWPORTS > idx && idx >= 0) ? idx : 0;
+}
+
 #endif
diff --git a/src/gallium/drivers/llvmpipe/lp_setup_line.c b/src/gallium/drivers/llvmpipe/lp_setup_line.c
index c2a069f..57a96d5 100644
--- a/src/gallium/drivers/llvmpipe/lp_setup_line.c
+++ b/src/gallium/drivers/llvmpipe/lp_setup_line.c
@@ -318,7 +318,7 @@ try_setup_line( struct lp_setup_context *setup,
       nr_planes = 8;
       if (setup->viewport_index_slot > 0) {
          unsigned *udata = (unsigned*)v1[setup->viewport_index_slot];
-         scissor_index = *udata;
+         scissor_index = lp_clamp_scissor_idx(*udata);
       }
    }
    else {
diff --git a/src/gallium/drivers/llvmpipe/lp_setup_point.c b/src/gallium/drivers/llvmpipe/lp_setup_point.c
index 30ce7490..b8040ae 100644
--- a/src/gallium/drivers/llvmpipe/lp_setup_point.c
+++ b/src/gallium/drivers/llvmpipe/lp_setup_point.c
@@ -328,7 +328,7 @@ try_setup_point( struct lp_setup_context *setup,
 
    if (setup->viewport_index_slot > 0) {
       unsigned *udata = (unsigned*)v0[setup->viewport_index_slot];
-      scissor_index = *udata;
+      scissor_index = lp_clamp_scissor_idx(*udata);
    }
    /* Bounding rectangle (in pixels) */
    {
diff --git a/src/gallium/drivers/llvmpipe/lp_setup_tri.c b/src/gallium/drivers/llvmpipe/lp_setup_tri.c
index c1ba52e..e0aaa19 100644
--- a/src/gallium/drivers/llvmpipe/lp_setup_tri.c
+++ b/src/gallium/drivers/llvmpipe/lp_setup_tri.c
@@ -258,7 +258,7 @@ do_triangle_ccw(struct lp_setup_context *setup,
       nr_planes = 7;
       if (setup->viewport_index_slot > 0) {
          unsigned *udata = (unsigned*)v0[setup->viewport_index_slot];
-         scissor_index = *udata;
+         scissor_index = lp_clamp_scissor_idx(*udata);
       }
    }
    else {
diff --git a/src/gallium/drivers/llvmpipe/lp_state_clip.c b/src/gallium/drivers/llvmpipe/lp_state_clip.c
index 0e027fa..2d4f27c 100644
--- a/src/gallium/drivers/llvmpipe/lp_state_clip.c
+++ b/src/gallium/drivers/llvmpipe/lp_state_clip.c
@@ -71,8 +71,12 @@ llvmpipe_set_scissor_states(struct pipe_context *pipe,
 
    draw_flush(llvmpipe->draw);
 
+   debug_assert(start_slot < PIPE_MAX_VIEWPORTS);
+   debug_assert((start_slot + num_scissors) <= PIPE_MAX_VIEWPORTS);
+
    memcpy(llvmpipe->scissors + start_slot, scissors,
           sizeof(struct pipe_scissor_state) * num_scissors);
+   
    llvmpipe->dirty |= LP_NEW_SCISSOR;
 }