[Mesa-dev] [PATCH 09/11] radeonsi: reject invalid vertex buffer indices at state creation

[Marek Olšák]

From: Marek Olšák <marek.olsak at amd.com>

---
 src/gallium/drivers/radeonsi/si_descriptors.c | 5 -----
 src/gallium/drivers/radeonsi/si_state.c       | 6 ++++++
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/gallium/drivers/radeonsi/si_descriptors.c b/src/gallium/drivers/radeonsi/si_descriptors.c
index deb6df9..fa3eaad 100644
--- a/src/gallium/drivers/radeonsi/si_descriptors.c
+++ b/src/gallium/drivers/radeonsi/si_descriptors.c
@@ -963,25 +963,20 @@ bool si_upload_vertex_buffer_descriptors(struct si_context *sctx)
 
 	assert(count <= SI_NUM_VERTEX_BUFFERS);
 
 	for (i = 0; i < count; i++) {
 		struct pipe_vertex_element *ve = &sctx->vertex_elements->elements[i];
 		struct pipe_vertex_buffer *vb;
 		struct r600_resource *rbuffer;
 		unsigned offset;
 		uint32_t *desc = &ptr[i*4];
 
-		if (ve->vertex_buffer_index >= ARRAY_SIZE(sctx->vertex_buffer)) {
-			memset(desc, 0, 16);
-			continue;
-		}
-
 		vb = &sctx->vertex_buffer[ve->vertex_buffer_index];
 		rbuffer = (struct r600_resource*)vb->buffer;
 		if (!rbuffer) {
 			memset(desc, 0, 16);
 			continue;
 		}
 
 		offset = vb->buffer_offset + ve->src_offset;
 		va = rbuffer->gpu_address + offset;
 
diff --git a/src/gallium/drivers/radeonsi/si_state.c b/src/gallium/drivers/radeonsi/si_state.c
index 4aa1cd7..3022260 100644
--- a/src/gallium/drivers/radeonsi/si_state.c
+++ b/src/gallium/drivers/radeonsi/si_state.c
@@ -3328,20 +3328,26 @@ static void *si_create_vertex_elements(struct pipe_context *ctx,
 	assert(count <= SI_MAX_ATTRIBS);
 	if (!v)
 		return NULL;
 
 	v->count = count;
 	for (i = 0; i < count; ++i) {
 		const struct util_format_description *desc;
 		const struct util_format_channel_description *channel;
 		unsigned data_format, num_format;
 		int first_non_void;
+		unsigned vbo_index = elements[i].vertex_buffer_index;
+
+		if (vbo_index >= SI_NUM_VERTEX_BUFFERS) {
+			FREE(v);
+			return NULL;
+		}
 
 		desc = util_format_description(elements[i].src_format);
 		first_non_void = util_format_get_first_non_void_channel(elements[i].src_format);
 		data_format = si_translate_buffer_dataformat(ctx->screen, desc, first_non_void);
 		num_format = si_translate_buffer_numformat(ctx->screen, desc, first_non_void);
 		channel = &desc->channel[first_non_void];
 
 		v->rsrc_word3[i] = S_008F0C_DST_SEL_X(si_map_swizzle(desc->swizzle[0])) |
 				   S_008F0C_DST_SEL_Y(si_map_swizzle(desc->swizzle[1])) |
 				   S_008F0C_DST_SEL_Z(si_map_swizzle(desc->swizzle[2])) |
-- 
2.7.4