Mesa (main): v3dv: duplicate key on hashtable insert

[GitLab Mirror]

Module: Mesa
Branch: main
Commit: 697e98c66e5ab10506b4a95c3e849c5d60d8e1a1
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=697e98c66e5ab10506b4a95c3e849c5d60d8e1a1

Author: Juan A. Suarez Romero <jasuarez at igalia.com>
Date:   Thu Apr 21 16:26:39 2022 +0200

v3dv: duplicate key on hashtable insert

The key is created on stack, so as soon as the function returns this key
is lost, so the inserted key in the hashtable is invalid.

Rather, insert a duplicated version on heap.

This fixes a stack-buffer-overflow when running some Vulkan CTS tests.

Signed-off-by: Juan A. Suarez Romero <jasuarez at igalia.com>
Reviewed-by: Iago Toral Quiroga <itoral at igalia.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/16083>

---

 src/broadcom/vulkan/v3dv_meta_copy.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/broadcom/vulkan/v3dv_meta_copy.c b/src/broadcom/vulkan/v3dv_meta_copy.c
index c474b507d52..a3a0eb47cde 100644
--- a/src/broadcom/vulkan/v3dv_meta_copy.c
+++ b/src/broadcom/vulkan/v3dv_meta_copy.c
@@ -1885,7 +1885,7 @@ get_copy_texel_buffer_pipeline(
    mtx_lock(&device->meta.mtx);
    struct hash_entry *entry =
       _mesa_hash_table_search(device->meta.texel_buffer_copy.cache[image_type],
-                              &key);
+                              key);
    if (entry) {
       mtx_unlock(&device->meta.mtx);
       *pipeline = entry->data;
@@ -1914,8 +1914,10 @@ get_copy_texel_buffer_pipeline(
    if (!ok)
       goto fail;
 
+   uint8_t *dupkey = malloc(V3DV_META_TEXEL_BUFFER_COPY_CACHE_KEY_SIZE);
+   memcpy(dupkey, key, V3DV_META_TEXEL_BUFFER_COPY_CACHE_KEY_SIZE);
    _mesa_hash_table_insert(device->meta.texel_buffer_copy.cache[image_type],
-                           &key, *pipeline);
+                           dupkey, *pipeline);
 
    mtx_unlock(&device->meta.mtx);
    return true;