Mesa (master): tgsi: fix out-of-bounds access for cube arrays

Ilia Mirkin imirkin at kemper.freedesktop.org
Fri Mar 27 01:12:04 UTC 2015


Module: Mesa
Branch: master
Commit: 626434893a048f3ba89a751998fcb3789a3dbb96
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=626434893a048f3ba89a751998fcb3789a3dbb96

Author: Ilia Mirkin <imirkin at alum.mit.edu>
Date:   Thu Mar 26 19:06:37 2015 -0400

tgsi: fix out-of-bounds access for cube arrays

The CUBE_ARRAY case uses r[4]. Make sure that the stack variable is
there.

Noticed by Coverity.

Signed-off-by: Ilia Mirkin <imirkin at alum.mit.edu>
Reviewed-by: Roland Scheidegger <sroland at vmware.com>

---

 src/gallium/auxiliary/tgsi/tgsi_exec.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/gallium/auxiliary/tgsi/tgsi_exec.c b/src/gallium/auxiliary/tgsi/tgsi_exec.c
index 8d08059..d9e4050 100644
--- a/src/gallium/auxiliary/tgsi/tgsi_exec.c
+++ b/src/gallium/auxiliary/tgsi/tgsi_exec.c
@@ -2344,7 +2344,7 @@ exec_sample(struct tgsi_exec_machine *mach,
 {
    const uint resource_unit = inst->Src[1].Register.Index;
    const uint sampler_unit = inst->Src[2].Register.Index;
-   union tgsi_exec_channel r[4], c1;
+   union tgsi_exec_channel r[5], c1;
    const union tgsi_exec_channel *lod = &ZeroVec;
    enum tgsi_sampler_control control = tgsi_sampler_lod_none;
    uint chan;




More information about the mesa-commit mailing list