[Mesa-dev] [Bug 102308] segfault in glCompressedTextureSubImage3D

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=102308

            Bug ID: 102308
           Summary: segfault in glCompressedTextureSubImage3D
           Product: Mesa
           Version: git
          Hardware: Other
                OS: All
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Mesa core
          Assignee: mesa-dev at lists.freedesktop.org
          Reporter: haagch at frickel.club
        QA Contact: mesa-dev at lists.freedesktop.org

I was trying to make "high fidelity" work on mesa, but with my limited OpenGL
knowledge maybe the code is wrong.

This is the call in question:
https://github.com/ChristophHaag/hifi/blob/ec6514b13b688a2aa6154359233dcb3f3186cc0e/libraries/gpu-gl/src/gpu/gl45/GL45BackendTexture.cpp#L161-L162

It causes this loop in compressed_tex_sub_image() to fail:
https://cgit.freedesktop.org/mesa/mesa/tree/src/mesa/main/teximage.c#n4955

The incoming texture has width x height 64x64.

Then as I understand it the texImage should be just a part of that texture,
however texImage->Width x texImage->Height is 64x64 too.

with that width and height, image_stride gets calculated to be 4096, which is
problematic, because imageSize was 4096 too.

So the loop ends up subtracting image_stride=4096 from imageSize=4096 six
times. Sometimes this segfaults, sometimes it runs into an assertion.

As I said, maybe the application code is wrong, but I think there is at least
some error checking in mesa missing.

valgrind also reported an invalid read in some maybe relevant code
https://gist.github.com/ChristophHaag/1af7eb4ef207a397460ff2c6719eba2e

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/mesa-dev/attachments/20170819/e416ad71/attachment.html>