[Mesa-dev] Mesa (master): draw: Prevent out-of-bounds vertex buffer access.

[José Fonseca]

Manuel,

Yeah. I ran into the bogus warnings over the weekend and pushed a fix 
this morning:

commit dcbc9be38ecea30506198d0db037cbf532f070e4
Author: José Fonseca <jose.r.fonseca at gmail.com>
Date:   Tue Apr 5 21:35:11 2011 +0100

     draw: Fix thinko in debug warnings.

Thanks for letting me know.

Jose


On 04/06/2011 11:52 AM, Manuel Massing wrote:
>
> Hi Jose,
>
> there seems to be a logic error in the commit
>
> 3733da31e8b4405b65e1b6ca3b6599ecc5af5fe7
>
> (see below for the relevant section).
>
> The "index out of range" message will be printed when the index is
>
> actually valid, the condition should be replaced by
>
> if (idx < min_index || idx > max_index)
>
> cheers,
>
> Manuel
>
> > --- a/src/gallium/auxiliary/draw/draw_pt_vsplit_tmp.h
>
> > +++ b/src/gallium/auxiliary/draw/draw_pt_vsplit_tmp.h
>
> > @@ -56,7 +56,9 @@ CONCAT(vsplit_primitive_, ELT_TYPE)(struct
>
> > vsplit_frontend *vsplit,
>
> >
>
> > for (i = 0; i < icount; i++) {
>
> > ELT_TYPE idx = ib[i];
>
> > - assert(idx >= min_index && idx <= max_index);
>
> > + if (idx >= min_index && idx <= max_index) {
>
> > + debug_printf("warning: index out of range\n");
>
> > + }
>
> > }
>
> > draw_elts = (const ushort *) ib;
>
> > }
>
> > @@ -87,7 +89,9 @@ CONCAT(vsplit_primitive_, ELT_TYPE)(struct
>
> > vsplit_frontend *vsplit, for (i = 0; i < icount; i++) {
>
> > ELT_TYPE idx = ib[i];
>
> >
>
> > - assert(idx >= min_index && idx <= max_index);
>
> > + if (idx >= min_index && idx <= max_index) {
>
> > + debug_printf("warning: index out of range\n");
>
> > + }
>
> > vsplit->draw_elts[i] = (ushort) idx;
>
> > }
>
> > }
>
> > @@ -95,7 +99,9 @@ CONCAT(vsplit_primitive_, ELT_TYPE)(struct
>
> > vsplit_frontend *vsplit, for (i = 0; i < icount; i++) {
>
> > ELT_TYPE idx = ib[i];
>
> >
>
> > - assert(idx >= min_index && idx <= max_index);
>
> > + if (idx >= min_index && idx <= max_index) {
>
> > + debug_printf("warning: index out of range\n");
>
> > + }
>
> > vsplit->draw_elts[i] = (ushort) (idx - min_index);
>
> > }
>
> > }
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/mesa-dev/attachments/20110406/e96def23/attachment-0001.htm>