Mesa (master): i965: verify format width in blorp_get_client_bo

[GitLab Mirror]

Module: Mesa
Branch: master
Commit: 0789f4b6d857d3188412d33f47bf3aa1873e2187
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=0789f4b6d857d3188412d33f47bf3aa1873e2187

Author: Marcin Ślusarz <marcin.slusarz at intel.com>
Date:   Thu Jul 30 14:56:44 2020 +0200

i965: verify format width in blorp_get_client_bo

Coverity complains about possible "Division or modulo by zero".

Signed-off-by: Marcin Ślusarz <marcin.slusarz at intel.com>
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin at intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/6126>

---

 src/mesa/drivers/dri/i965/brw_blorp.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/mesa/drivers/dri/i965/brw_blorp.c b/src/mesa/drivers/dri/i965/brw_blorp.c
index c2225b390fd..76471f5e3e8 100644
--- a/src/mesa/drivers/dri/i965/brw_blorp.c
+++ b/src/mesa/drivers/dri/i965/brw_blorp.c
@@ -853,7 +853,6 @@ blorp_get_client_bo(struct brw_context *brw,
                                                    format, type,
                                                    d - 1, h - 1, w);
    const uint32_t stride = _mesa_image_row_stride(packing, w, format, type);
-   const uint32_t cpp = _mesa_bytes_per_pixel(format, type);
    const uint32_t size = last_pixel - first_pixel;
 
    *row_stride_out = stride;
@@ -861,9 +860,15 @@ blorp_get_client_bo(struct brw_context *brw,
 
    if (packing->BufferObj) {
       const uint32_t offset = first_pixel + (intptr_t)pixels;
-      if (!read_only && ((offset % cpp) || (stride % cpp))) {
-         perf_debug("Bad PBO alignment; fallback to CPU mapping\n");
-         return NULL;
+
+      if (!read_only) {
+         const int32_t cpp = _mesa_bytes_per_pixel(format, type);
+         assert(cpp > 0);
+
+         if ((offset % cpp) || (stride % cpp)) {
+            perf_debug("Bad PBO alignment; fallback to CPU mapping\n");
+            return NULL;
+         }
       }
 
       /* This is a user-provided PBO. We just need to get the BO out */