Mesa (master): mesa: add bounds checking to eliminate buffer overrun
Kenneth Graunke
kwg at kemper.freedesktop.org
Tue Apr 8 19:57:02 UTC 2014
Module: Mesa
Branch: master
Commit: cb4ad1368551b64756c7b6e2007588e34739b188
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=cb4ad1368551b64756c7b6e2007588e34739b188
Author: Courtney Goeltzenleuchter <courtney at lunarg.com>
Date: Tue Apr 8 09:10:09 2014 -0600
mesa: add bounds checking to eliminate buffer overrun
Decompressing ETC2 textures was causing intermitent segfault
by copying resulting 4x4 texel block to the destination texture
regardless of the size of the destination texture. Issue found
via application crash in GLBenchmark 3.0's Manhattan test.
v2: add more detail comment. Compute limit outside inner loops.
v3: add bugzilla reference
v4: Correct cc syntax in commit log
v5: really grab the right patch
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=74988
Cc: "9.2 10.0 10.1" <mesa-stable at lists.freedesktop.org>
Reviewed-by: Kenneth Graunke <kenneth at whitecape.org>
Reviewed-by: Ian Romanick <ian.d.romanick at intel.com> [v1, suggested v2-3]
---
src/mesa/main/texcompress_etc.c | 78 +++++++++++++++++++++++++++------------
1 file changed, 54 insertions(+), 24 deletions(-)
diff --git a/src/mesa/main/texcompress_etc.c b/src/mesa/main/texcompress_etc.c
index cbda689..7501982 100644
--- a/src/mesa/main/texcompress_etc.c
+++ b/src/mesa/main/texcompress_etc.c
@@ -678,14 +678,25 @@ etc2_unpack_rgb8(uint8_t *dst_row,
for (y = 0; y < height; y += bh) {
const uint8_t *src = src_row;
+ /*
+ * Destination texture may not be a multiple of four texels in
+ * height. Compute a safe height to avoid writing outside the texture.
+ */
+ const unsigned h = MIN2(bh, height - y);
for (x = 0; x < width; x+= bw) {
etc2_rgb8_parse_block(&block, src,
false /* punchthrough_alpha */);
- for (j = 0; j < bh; j++) {
+ /*
+ * Destination texture may not be a multiple of four texels in
+ * width. Compute a safe width to avoid writing outside the texture.
+ */
+ const unsigned w = MIN2(bw, width - x);
+
+ for (j = 0; j < h; j++) {
uint8_t *dst = dst_row + (y + j) * dst_stride + x * comps;
- for (i = 0; i < bw; i++) {
+ for (i = 0; i < w; i++) {
etc2_rgb8_fetch_texel(&block, i, j, dst,
false /* punchthrough_alpha */);
dst[3] = 255;
@@ -715,14 +726,17 @@ etc2_unpack_srgb8(uint8_t *dst_row,
for (y = 0; y < height; y += bh) {
const uint8_t *src = src_row;
+ const unsigned h = MIN2(bh, height - y);
for (x = 0; x < width; x+= bw) {
+ const unsigned w = MIN2(bw, width - x);
etc2_rgb8_parse_block(&block, src,
false /* punchthrough_alpha */);
- for (j = 0; j < bh; j++) {
+
+ for (j = 0; j < h; j++) {
uint8_t *dst = dst_row + (y + j) * dst_stride + x * comps;
- for (i = 0; i < bw; i++) {
+ for (i = 0; i < w; i++) {
etc2_rgb8_fetch_texel(&block, i, j, dst,
false /* punchthrough_alpha */);
/* Convert to MESA_FORMAT_B8G8R8A8_SRGB */
@@ -759,13 +773,15 @@ etc2_unpack_rgba8(uint8_t *dst_row,
for (y = 0; y < height; y += bh) {
const uint8_t *src = src_row;
+ const unsigned h = MIN2(bh, height - y);
for (x = 0; x < width; x+= bw) {
+ const unsigned w = MIN2(bw, width - x);
etc2_rgba8_parse_block(&block, src);
- for (j = 0; j < bh; j++) {
+ for (j = 0; j < h; j++) {
uint8_t *dst = dst_row + (y + j) * dst_stride + x * comps;
- for (i = 0; i < bw; i++) {
+ for (i = 0; i < w; i++) {
etc2_rgba8_fetch_texel(&block, i, j, dst);
dst += comps;
}
@@ -795,14 +811,16 @@ etc2_unpack_srgb8_alpha8(uint8_t *dst_row,
uint8_t tmp;
for (y = 0; y < height; y += bh) {
+ const unsigned h = MIN2(bh, height - y);
const uint8_t *src = src_row;
for (x = 0; x < width; x+= bw) {
+ const unsigned w = MIN2(bw, width - x);
etc2_rgba8_parse_block(&block, src);
- for (j = 0; j < bh; j++) {
+ for (j = 0; j < h; j++) {
uint8_t *dst = dst_row + (y + j) * dst_stride + x * comps;
- for (i = 0; i < bw; i++) {
+ for (i = 0; i < w; i++) {
etc2_rgba8_fetch_texel(&block, i, j, dst);
/* Convert to MESA_FORMAT_B8G8R8A8_SRGB */
@@ -837,14 +855,16 @@ etc2_unpack_r11(uint8_t *dst_row,
unsigned x, y, i, j;
for (y = 0; y < height; y += bh) {
+ const unsigned h = MIN2(bh, height - y);
const uint8_t *src = src_row;
for (x = 0; x < width; x+= bw) {
+ const unsigned w = MIN2(bw, width - x);
etc2_r11_parse_block(&block, src);
- for (j = 0; j < bh; j++) {
+ for (j = 0; j < h; j++) {
uint8_t *dst = dst_row + (y + j) * dst_stride + x * comps * comp_size;
- for (i = 0; i < bw; i++) {
+ for (i = 0; i < w; i++) {
etc2_r11_fetch_texel(&block, i, j, dst);
dst += comps * comp_size;
}
@@ -872,16 +892,18 @@ etc2_unpack_rg11(uint8_t *dst_row,
unsigned x, y, i, j;
for (y = 0; y < height; y += bh) {
+ const unsigned h = MIN2(bh, height - y);
const uint8_t *src = src_row;
for (x = 0; x < width; x+= bw) {
+ const unsigned w = MIN2(bw, width - x);
/* red component */
etc2_r11_parse_block(&block, src);
- for (j = 0; j < bh; j++) {
+ for (j = 0; j < h; j++) {
uint8_t *dst = dst_row + (y + j) * dst_stride +
x * comps * comp_size;
- for (i = 0; i < bw; i++) {
+ for (i = 0; i < w; i++) {
etc2_r11_fetch_texel(&block, i, j, dst);
dst += comps * comp_size;
}
@@ -889,10 +911,10 @@ etc2_unpack_rg11(uint8_t *dst_row,
/* green component */
etc2_r11_parse_block(&block, src + 8);
- for (j = 0; j < bh; j++) {
+ for (j = 0; j < h; j++) {
uint8_t *dst = dst_row + (y + j) * dst_stride +
x * comps * comp_size;
- for (i = 0; i < bw; i++) {
+ for (i = 0; i < w; i++) {
etc2_r11_fetch_texel(&block, i, j, dst + comp_size);
dst += comps * comp_size;
}
@@ -920,15 +942,17 @@ etc2_unpack_signed_r11(uint8_t *dst_row,
unsigned x, y, i, j;
for (y = 0; y < height; y += bh) {
+ const unsigned h = MIN2(bh, height - y);
const uint8_t *src = src_row;
for (x = 0; x < width; x+= bw) {
+ const unsigned w = MIN2(bw, width - x);
etc2_r11_parse_block(&block, src);
- for (j = 0; j < bh; j++) {
+ for (j = 0; j < h; j++) {
uint8_t *dst = dst_row + (y + j) * dst_stride +
x * comps * comp_size;
- for (i = 0; i < bw; i++) {
+ for (i = 0; i < w; i++) {
etc2_signed_r11_fetch_texel(&block, i, j, dst);
dst += comps * comp_size;
}
@@ -956,16 +980,18 @@ etc2_unpack_signed_rg11(uint8_t *dst_row,
unsigned x, y, i, j;
for (y = 0; y < height; y += bh) {
+ const unsigned h = MIN2(bh, height - y);
const uint8_t *src = src_row;
for (x = 0; x < width; x+= bw) {
+ const unsigned w = MIN2(bw, width - x);
/* red component */
etc2_r11_parse_block(&block, src);
- for (j = 0; j < bh; j++) {
+ for (j = 0; j < h; j++) {
uint8_t *dst = dst_row + (y + j) * dst_stride +
x * comps * comp_size;
- for (i = 0; i < bw; i++) {
+ for (i = 0; i < w; i++) {
etc2_signed_r11_fetch_texel(&block, i, j, dst);
dst += comps * comp_size;
}
@@ -973,10 +999,10 @@ etc2_unpack_signed_rg11(uint8_t *dst_row,
/* green component */
etc2_r11_parse_block(&block, src + 8);
- for (j = 0; j < bh; j++) {
+ for (j = 0; j < h; j++) {
uint8_t *dst = dst_row + (y + j) * dst_stride +
x * comps * comp_size;
- for (i = 0; i < bw; i++) {
+ for (i = 0; i < w; i++) {
etc2_signed_r11_fetch_texel(&block, i, j, dst + comp_size);
dst += comps * comp_size;
}
@@ -1001,14 +1027,16 @@ etc2_unpack_rgb8_punchthrough_alpha1(uint8_t *dst_row,
unsigned x, y, i, j;
for (y = 0; y < height; y += bh) {
+ const unsigned h = MIN2(bh, height - y);
const uint8_t *src = src_row;
for (x = 0; x < width; x+= bw) {
+ const unsigned w = MIN2(bw, width - x);
etc2_rgb8_parse_block(&block, src,
true /* punchthrough_alpha */);
- for (j = 0; j < bh; j++) {
+ for (j = 0; j < h; j++) {
uint8_t *dst = dst_row + (y + j) * dst_stride + x * comps;
- for (i = 0; i < bw; i++) {
+ for (i = 0; i < w; i++) {
etc2_rgb8_fetch_texel(&block, i, j, dst,
true /* punchthrough_alpha */);
dst += comps;
@@ -1036,14 +1064,16 @@ etc2_unpack_srgb8_punchthrough_alpha1(uint8_t *dst_row,
uint8_t tmp;
for (y = 0; y < height; y += bh) {
+ const unsigned h = MIN2(bh, height - y);
const uint8_t *src = src_row;
for (x = 0; x < width; x+= bw) {
+ const unsigned w = MIN2(bw, width - x);
etc2_rgb8_parse_block(&block, src,
true /* punchthrough_alpha */);
- for (j = 0; j < bh; j++) {
+ for (j = 0; j < h; j++) {
uint8_t *dst = dst_row + (y + j) * dst_stride + x * comps;
- for (i = 0; i < bw; i++) {
+ for (i = 0; i < w; i++) {
etc2_rgb8_fetch_texel(&block, i, j, dst,
true /* punchthrough_alpha */);
/* Convert to MESA_FORMAT_B8G8R8A8_SRGB */
More information about the mesa-commit
mailing list