On Jun 3, 2016 11:29 AM, "Kenneth Graunke" <<a href="mailto:kenneth@whitecape.org">kenneth@whitecape.org</a>> wrote: > > On Friday, June 3, 2016 10:28:34 AM PDT Jason Ekstrand wrote: > > On Jun 3, 2016 8:43 AM, <<a href="mailto:robert.foss@collabora.com">robert.foss@collabora.com</a>> wrote: > > > > > > From: Robert Foss <<a href="mailto:robert.foss@collabora.com">robert.foss@collabora.com</a>> > > > > > > Avoid out of bounds access of the array 'src'. > > > > > > 'src' is passed along: > > > nir_eval_const_opcode() > > > evaluate_bitfield_insert() > > > > > > In evaluate_bitfield_insert() an access to src[3] is made > > > if bit_size==32 wich it always will be due to the > > > assert(bit_size == 32) on spirv_to_nir.c:1045. > > > > > > Since 'src' is of length 3, this is out of bounds. > > > > > > Coverity id: 1358582 > > > > > > Signed-off-by: Robert Foss <<a href="mailto:robert.foss@collabora.com">robert.foss@collabora.com</a>> > > > --- > > > src/compiler/spirv/spirv_to_nir.c | 2 +- > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > diff --git a/src/compiler/spirv/spirv_to_nir.c > > b/src/compiler/spirv/spirv_to_nir.c > > > index 99514b4..46ede6a 100644 > > > --- a/src/compiler/spirv/spirv_to_nir.c > > > +++ b/src/compiler/spirv/spirv_to_nir.c > > > @@ -1035,7 +1035,7 @@ vtn_handle_constant(struct vtn_builder *b, SpvOp > > opcode, > > > unsigned bit_size = > > > glsl_get_bit_size(glsl_get_base_type(val->const_type)); > > > > > > - nir_const_value src[3]; > > > + nir_const_value src[4]; > > > > None of the Opcode's evaluated as specialization constants have four > > sources so this will never be a problem. Hence the assert on the next > > line. I think we should just mark this as a false positive. > > > > > assert(count <= 7); > > > for (unsigned i = 0; i < count - 4; i++) { > > > nir_constant *c = > > Would promoting assert(count <= 7) to assume(count <= 7) make Coverity > happy? (CC'd Matt, he'd probably know...) I thought about that but I doubt it. What coverity really needs to know is that it will never get any 4-src opcodes which isn't really clear from count. > --Ken