<div dir="ltr"><div dir="ltr">Hi all, Could somebody push this small patch to mesa? Regards, Andrii.<div><div class="gmail_quote"><div dir="ltr">On Mon, Aug 20, 2018 at 9:13 PM Lionel Landwerlin <<a href="mailto:lionel.g.landwerlin@intel.com">lionel.g.landwerlin@intel.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 20/08/2018 17:20, <a href="mailto:asimiklit.work@gmail.com" target="_blank">asimiklit.work@gmail.com</a> wrote: > From: Andrii Simiklit <<a href="mailto:andrii.simiklit@globallogic.com" target="_blank">andrii.simiklit@globallogic.com</a>> > > The "gen_group_get_length" function can return a negative value > and it can lead to the out of bounds group_iter. > > v2: printing of "unknown command type" was added > v3: just the asserts are added > > Signed-off-by: Andrii Simiklit <<a href="mailto:andrii.simiklit@globallogic.com" target="_blank">andrii.simiklit@globallogic.com</a>> Reviewed-by: Lionel Landwerlin <<a href="mailto:lionel.g.landwerlin@intel.com" target="_blank">lionel.g.landwerlin@intel.com</a>> Somebody should take a look at the other patches I sent out ;) Thanks! - Lionel > --- > src/intel/common/gen_decoder.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/src/intel/common/gen_decoder.c b/src/intel/common/gen_decoder.c > index ec0a486..2d9609a 100644 > --- a/src/intel/common/gen_decoder.c > +++ b/src/intel/common/gen_decoder.c > @@ -803,8 +803,10 @@ static bool > iter_more_groups(const struct gen_field_iterator *iter) > { > if (iter->group->variable) { > + int length = gen_group_get_length(iter->group, iter->p); > + assert(length >= 0 && "error the length is unknown!"); > return iter_group_offset_bits(iter, iter->group_iter + 1) < > - (gen_group_get_length(iter->group, iter->p) * 32); > + (length * 32); > } else { > return (iter->group_iter + 1) < iter->group->group_count || > iter->group->next != NULL; > @@ -991,6 +993,7 @@ gen_field_iterator_init(struct gen_field_iterator *iter, > iter->p_bit = p_bit; > > int length = gen_group_get_length(iter->group, iter->p); > + assert(length >= 0 && "error the length is unknown!"); > iter->p_end = length > 0 ? &p[length] : NULL; > iter->print_colors = print_colors; > } </blockquote></div></div></div></div>