[Mesa-stable] [Mesa-dev] [PATCH 1/4] nv50: add missing brackets when handling the samplers array

[Ilia Mirkin]

On Wed, Mar 12, 2014 at 1:24 PM, Emil Velikov <emil.l.velikov at gmail.com> wrote:
> Commit 3805a864b1d(nv50: assert before trying to out-of-bounds access
> samplers) introduced a series of asserts as a precausion of a previous
> illegal memory access.
>
> Although it failed to encapsulate loop within nv50_sampler_state_delete
> effectively failing to clear the sampler state, apart from exadurating
> the illegal memory access issue.
>
> Fixes gcc warning "array subscript is above array bounds" and
> "Nesting level does not match indentation" and "Out-of-bounds read"
> defects reported by Coverity.
>
> Cc: "10.1" <mesa-stable at lists.freedesktop.org>
> Signed-off-by: Emil Velikov <emil.l.velikov at gmail.com>

Reviewed-by: Ilia Mirkin <imirkin at alum.mit.edu>

> ---
>  src/gallium/drivers/nouveau/nv50/nv50_state.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/src/gallium/drivers/nouveau/nv50/nv50_state.c b/src/gallium/drivers/nouveau/nv50/nv50_state.c
> index 862636b..647c01f 100644
> --- a/src/gallium/drivers/nouveau/nv50/nv50_state.c
> +++ b/src/gallium/drivers/nouveau/nv50/nv50_state.c
> @@ -558,11 +558,12 @@ nv50_sampler_state_delete(struct pipe_context *pipe, void *hwcso)
>  {
>     unsigned s, i;
>
> -   for (s = 0; s < 3; ++s)
> +   for (s = 0; s < 3; ++s) {
>        assert(nv50_context(pipe)->num_samplers[s] <= PIPE_MAX_SAMPLERS);
>        for (i = 0; i < nv50_context(pipe)->num_samplers[s]; ++i)
>           if (nv50_context(pipe)->samplers[s][i] == hwcso)
>              nv50_context(pipe)->samplers[s][i] = NULL;
> +   }
>
>     nv50_screen_tsc_free(nv50_context(pipe)->screen, nv50_tsc_entry(hwcso));
>
> --
> 1.9.0
>
> _______________________________________________
> mesa-dev mailing list
> mesa-dev at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/mesa-dev