[Mesa-stable] [PATCH 1/4] nv50: add missing brackets when handling the samplers array

Emil Velikov emil.l.velikov at gmail.com
Wed Mar 12 10:24:16 PDT 2014


Commit 3805a864b1d(nv50: assert before trying to out-of-bounds access
samplers) introduced a series of asserts as a precausion of a previous
illegal memory access.

Although it failed to encapsulate loop within nv50_sampler_state_delete
effectively failing to clear the sampler state, apart from exadurating
the illegal memory access issue.

Fixes gcc warning "array subscript is above array bounds" and
"Nesting level does not match indentation" and "Out-of-bounds read"
defects reported by Coverity.

Cc: "10.1" <mesa-stable at lists.freedesktop.org>
Signed-off-by: Emil Velikov <emil.l.velikov at gmail.com>
---
 src/gallium/drivers/nouveau/nv50/nv50_state.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/gallium/drivers/nouveau/nv50/nv50_state.c b/src/gallium/drivers/nouveau/nv50/nv50_state.c
index 862636b..647c01f 100644
--- a/src/gallium/drivers/nouveau/nv50/nv50_state.c
+++ b/src/gallium/drivers/nouveau/nv50/nv50_state.c
@@ -558,11 +558,12 @@ nv50_sampler_state_delete(struct pipe_context *pipe, void *hwcso)
 {
    unsigned s, i;
 
-   for (s = 0; s < 3; ++s)
+   for (s = 0; s < 3; ++s) {
       assert(nv50_context(pipe)->num_samplers[s] <= PIPE_MAX_SAMPLERS);
       for (i = 0; i < nv50_context(pipe)->num_samplers[s]; ++i)
          if (nv50_context(pipe)->samplers[s][i] == hwcso)
             nv50_context(pipe)->samplers[s][i] = NULL;
+   }
 
    nv50_screen_tsc_free(nv50_context(pipe)->screen, nv50_tsc_entry(hwcso));
 
-- 
1.9.0



More information about the mesa-stable mailing list