Mesa (staging/21.2): lima: avoid crash with negative viewport values
GitLab Mirror
gitlab-mirror at kemper.freedesktop.org
Tue Jul 27 18:59:27 UTC 2021
Module: Mesa
Branch: staging/21.2
Commit: fc9650d1f398933dcf0ae1c1ca970b574b44bf17
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=fc9650d1f398933dcf0ae1c1ca970b574b44bf17
Author: Erico Nunes <nunes.erico at gmail.com>
Date: Sun Jul 25 13:48:59 2021 +0200
lima: avoid crash with negative viewport values
The viewport value computations done in lima_set_viewport_states
can result in a negative value for viewport.
These could end up converted to unsigned values in
lima_clip_scissor_to_viewport causing crashes from invalid
scissor commands.
Prevent this by limiting the minimum value to zero as is already
done for the left and bottom values.
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/2938
Cc: mesa-stable
Signed-off-by: Erico Nunes <nunes.erico at gmail.com>
Reviewed-by: Vasily Khoruzhick <anarsoul at gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/12055>
(cherry picked from commit e6cdb01c517b42dece9ed532fd6eba7a74aa8f71)
---
.pick_status.json | 2 +-
src/gallium/drivers/lima/lima_draw.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/.pick_status.json b/.pick_status.json
index 5068d56d55b..e2e9c7f72d9 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -112,7 +112,7 @@
"description": "lima: avoid crash with negative viewport values",
"nominated": true,
"nomination_type": 0,
- "resolution": 0,
+ "resolution": 1,
"main_sha": null,
"because_sha": null
},
diff --git a/src/gallium/drivers/lima/lima_draw.c b/src/gallium/drivers/lima/lima_draw.c
index 3d29fcc601b..161fc7288a5 100644
--- a/src/gallium/drivers/lima/lima_draw.c
+++ b/src/gallium/drivers/lima/lima_draw.c
@@ -72,14 +72,14 @@ lima_clip_scissor_to_viewport(struct lima_context *ctx)
viewport_left = MAX2(ctx->viewport.left, 0);
cscissor->minx = MAX2(cscissor->minx, viewport_left);
- viewport_right = MIN2(ctx->viewport.right, fb->base.width);
+ viewport_right = MIN2(MAX2(ctx->viewport.right, 0), fb->base.width);
cscissor->maxx = MIN2(cscissor->maxx, viewport_right);
if (cscissor->minx > cscissor->maxx)
cscissor->minx = cscissor->maxx;
viewport_bottom = MAX2(ctx->viewport.bottom, 0);
cscissor->miny = MAX2(cscissor->miny, viewport_bottom);
- viewport_top = MIN2(ctx->viewport.top, fb->base.height);
+ viewport_top = MIN2(MAX2(ctx->viewport.top, 0), fb->base.height);
cscissor->maxy = MIN2(cscissor->maxy, viewport_top);
if (cscissor->miny > cscissor->maxy)
cscissor->miny = cscissor->maxy;
More information about the mesa-commit
mailing list