[Mesa-dev] [PATCH] mesa: Fix out of bounds writes when uncompressing non-block-aligned ETC1.

[Kenneth Graunke]

On 01/10/2013 06:06 PM, Eric Anholt wrote:
> Fixes a crash in GLB2.1 offscreen on the glthread branch.
> ---
>   src/mesa/main/texcompress_etc_tmp.h |    4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/src/mesa/main/texcompress_etc_tmp.h b/src/mesa/main/texcompress_etc_tmp.h
> index 8bbb2cd..5497566 100644
> --- a/src/mesa/main/texcompress_etc_tmp.h
> +++ b/src/mesa/main/texcompress_etc_tmp.h
> @@ -153,9 +153,9 @@ etc1_unpack_rgba8888(uint8_t *dst_row,
>         for (x = 0; x < width; x+= bw) {
>            etc1_parse_block(&block, src);
>
> -         for (j = 0; j < bh; j++) {
> +         for (j = 0; j < MIN2(bh, height - y); j++) {
>               uint8_t *dst = dst_row + (y + j) * dst_stride + x * comps;
> -            for (i = 0; i < bw; i++) {
> +            for (i = 0; i < MIN2(bw, width - x); i++) {
>                  etc1_fetch_texel(&block, i, j, dst);
>                  dst[3] = 255;
>                  dst += comps;

Nice find.

Reviewed-by: Kenneth Graunke <kenneth at whitecape.org>