[Mesa-dev] [PATCH 1/3] i915: Fix out-of-bounds array access in live reg calculation.

[Eric Anholt]

This live regs calc is used to find which of the 16 registers can be
used as a temp during texturing.  However, if 17 regs were used in the
program, we'd smash the stack.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=40022
---

I need to run piglit on this one tomorrow.  Looks obvious, though.

 src/mesa/drivers/dri/i915/i915_fragprog.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/mesa/drivers/dri/i915/i915_fragprog.c b/src/mesa/drivers/dri/i915/i915_fragprog.c
index d155b85..38d4b3a 100644
--- a/src/mesa/drivers/dri/i915/i915_fragprog.c
+++ b/src/mesa/drivers/dri/i915/i915_fragprog.c
@@ -315,7 +315,7 @@ static bool calc_live_regs( struct i915_fragment_program *p )
 
         /* Register is written to: unmark as live for this and preceeding ops */ 
         if (inst->DstReg.File == PROGRAM_TEMPORARY) {
-	    if (inst->DstReg.Index > 16)
+	    if (inst->DstReg.Index >= 16)
 	       return false;
 
             live_components[inst->DstReg.Index] &= ~inst->DstReg.WriteMask;
@@ -328,7 +328,7 @@ static bool calc_live_regs( struct i915_fragment_program *p )
             if (inst->SrcReg[a].File == PROGRAM_TEMPORARY) {
                 unsigned c;
 
-		if (inst->SrcReg[a].Index > 16)
+		if (inst->SrcReg[a].Index >= 16)
 		   return false;
 
                 regsUsed |= 1 << inst->SrcReg[a].Index;
-- 
1.7.5.4