Mesa (main): radv: fix copying mutable descriptors to sampler descriptors

[GitLab Mirror]

Module: Mesa
Branch: main
Commit: ce5d7bf5085de668d3203f922822f71d4bc0d6b2
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=ce5d7bf5085de668d3203f922822f71d4bc0d6b2

Author: Samuel Pitoiset <samuel.pitoiset at gmail.com>
Date:   Tue Dec 28 11:01:38 2021 +0100

radv: fix copying mutable descriptors to sampler descriptors

This fixes a heap-buffer-overflow detected by ASAN.

Signed-off-by: Samuel Pitoiset <samuel.pitoiset at gmail.com>
Reviewed-by: Bas Nieuwenhuizen <bas at basnieuwenhuizen.nl>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/14330>

---

 src/amd/vulkan/radv_descriptor_set.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/amd/vulkan/radv_descriptor_set.c b/src/amd/vulkan/radv_descriptor_set.c
index 1c8ee0d7a0d..e0f2d762b81 100644
--- a/src/amd/vulkan/radv_descriptor_set.c
+++ b/src/amd/vulkan/radv_descriptor_set.c
@@ -1283,8 +1283,10 @@ radv_update_descriptor_sets_impl(struct radv_device *device, struct radv_cmd_buf
          dst_ptr += dst_binding_layout->size / 4;
 
          if (src_binding_layout->type != VK_DESCRIPTOR_TYPE_SAMPLER &&
-             src_binding_layout->type != VK_DESCRIPTOR_TYPE_ACCELERATION_STRUCTURE_KHR) {
-            /* Sampler descriptors don't have a buffer list. */
+             dst_binding_layout->type != VK_DESCRIPTOR_TYPE_SAMPLER &&
+             src_binding_layout->type != VK_DESCRIPTOR_TYPE_ACCELERATION_STRUCTURE_KHR &&
+             dst_binding_layout->type != VK_DESCRIPTOR_TYPE_ACCELERATION_STRUCTURE_KHR) {
+            /* Sampler/acceleration structure descriptors don't have a buffer list. */
             dst_buffer_list[j] = src_buffer_list[j];
          }
       }