[Mesa-dev] [PATCH] st/mesa: fix segfault in BufferData if size is 0 and buffer is NULL

[Brian Paul]

I seem to recall adding a bunch of null pointer checks to the 
st_cb_bufferobjects.c code in the past to avoid crashing in some 
out-of-memory situations.  I think we should check for null pointers 
wherever possible.

-Brian

On 04/25/2013 02:48 PM, Jose Fonseca wrote:
> Looks good to me. Thanks.
>
> Jose
>
> ----- Original Message -----
>> If the size is 0, there is nothing to do and st_obj->buffer can be NULL.
>> st_obj->buffer should not be NULL in any other case.
>>
>> This fixes a segfault in Topogun. Reported by Jose Fonseca.
>> ---
>>   src/mesa/state_tracker/st_cb_bufferobjects.c |    5 ++++-
>>   1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/src/mesa/state_tracker/st_cb_bufferobjects.c
>> b/src/mesa/state_tracker/st_cb_bufferobjects.c
>> index 1b3991c..b1fbe03 100644
>> --- a/src/mesa/state_tracker/st_cb_bufferobjects.c
>> +++ b/src/mesa/state_tracker/st_cb_bufferobjects.c
>> @@ -182,13 +182,16 @@ st_bufferobj_data(struct gl_context *ctx,
>>      struct st_buffer_object *st_obj = st_buffer_object(obj);
>>      unsigned bind, pipe_usage;
>>
>> -   if (st_obj->Base.Size == size&&  st_obj->Base.Usage == usage&&  data) {
>> +   if (size&&  data&&
>> +       st_obj->Base.Size == size&&  st_obj->Base.Usage == usage) {
>>         /* Just discard the old contents and write new data.
>>          * This should be the same as creating a new buffer, but we avoid
>>          * a lot of validation in Mesa.
>>          */
>>         struct pipe_box box;
>>
>> +      assert(st_obj->buffer);
>> +
>>         u_box_1d(0, size,&box);
>>         pipe->transfer_inline_write(pipe, st_obj->buffer, 0,
>>                                     PIPE_TRANSFER_DISCARD_WHOLE_RESOURCE,
>> --
>> 1.7.10.4
>>
>> _______________________________________________
>> mesa-dev mailing list
>> mesa-dev at lists.freedesktop.org
>> http://lists.freedesktop.org/mailman/listinfo/mesa-dev
>>
> _______________________________________________
> mesa-dev mailing list
> mesa-dev at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/mesa-dev