[Mesa-dev] [PATCH 1/2] radv: fix out-of-bounds access when copying descriptors BO list

[Samuel Pitoiset]

We shouldn't increment the buffer list pointers twice.

This fixes some crashes with new CTS
dEQP-VK.binding_model.descriptor_copy.*.

Cc: 18.3 19.0 <mesa-stable at lists.freedesktop.org>
Signed-off-by: Samuel Pitoiset <samuel.pitoiset at gmail.com>
---
 src/amd/vulkan/radv_descriptor_set.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/amd/vulkan/radv_descriptor_set.c b/src/amd/vulkan/radv_descriptor_set.c
index e47ae6ad67a..e6649305961 100644
--- a/src/amd/vulkan/radv_descriptor_set.c
+++ b/src/amd/vulkan/radv_descriptor_set.c
@@ -970,8 +970,6 @@ void radv_update_descriptor_sets(
 			src_ptr += src_binding_layout->size / 4;
 			dst_ptr += dst_binding_layout->size / 4;
 			dst_buffer_list[j] = src_buffer_list[j];
-			++src_buffer_list;
-			++dst_buffer_list;
 		}
 	}
 }
-- 
2.20.1