[Mesa-dev] [PATCH] tgsi: fix out-of-bounds access for cube arrays

Ilia Mirkin imirkin at alum.mit.edu
Thu Mar 26 16:06:37 PDT 2015


The CUBE_ARRAY case uses r[4]. Make sure that the stack variable is
there.

Noticed by Coverity.

Signed-off-by: Ilia Mirkin <imirkin at alum.mit.edu>
---
 src/gallium/auxiliary/tgsi/tgsi_exec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/gallium/auxiliary/tgsi/tgsi_exec.c b/src/gallium/auxiliary/tgsi/tgsi_exec.c
index 8d08059..d9e4050 100644
--- a/src/gallium/auxiliary/tgsi/tgsi_exec.c
+++ b/src/gallium/auxiliary/tgsi/tgsi_exec.c
@@ -2344,7 +2344,7 @@ exec_sample(struct tgsi_exec_machine *mach,
 {
    const uint resource_unit = inst->Src[1].Register.Index;
    const uint sampler_unit = inst->Src[2].Register.Index;
-   union tgsi_exec_channel r[4], c1;
+   union tgsi_exec_channel r[5], c1;
    const union tgsi_exec_channel *lod = &ZeroVec;
    enum tgsi_sampler_control control = tgsi_sampler_lod_none;
    uint chan;
-- 
2.0.5



More information about the mesa-dev mailing list