[Piglit] [PATCH 1/2] oes_compressed_paletted_texture: prevent accessing buffer out of bounds

Nanley Chery nanleychery at gmail.com
Mon Jul 27 14:13:12 PDT 2015


From: Nanley Chery <nanley.g.chery at intel.com>

The buffer variable is too small to accomodate running the
[Compressed]TexImage commands with the GL_PALETTE8_RGBA8_OES format
(which needs 1024 bytes instead of the 768 allocated). Rely on the GL
behavior of allocating unspecified memory when a NULL pointer is passed.

Signed-off-by: Nanley Chery <nanley.g.chery at intel.com>
Cc: Ian Romanick <ian.d.romanick at intel.com>
---
 .../oes_compressed_paletted_texture-api.c                     | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/tests/spec/oes_compressed_paletted_texture/oes_compressed_paletted_texture-api.c b/tests/spec/oes_compressed_paletted_texture/oes_compressed_paletted_texture-api.c
index 13b0bba..4d9f5b7 100644
--- a/tests/spec/oes_compressed_paletted_texture/oes_compressed_paletted_texture-api.c
+++ b/tests/spec/oes_compressed_paletted_texture/oes_compressed_paletted_texture-api.c
@@ -63,7 +63,6 @@ piglit_display(void)
 void
 piglit_init(int argc, char **argv)
 {
-	GLubyte buffer[512 + (16 * 16)];
 	GLuint tex;
 	GLsizei size;
 	unsigned i;
@@ -98,7 +97,7 @@ piglit_init(int argc, char **argv)
 	for (i = 0; i < ARRAY_SIZE(t); i++) {
 		glTexImage2D(GL_TEXTURE_2D, 0, t[i].internal_format,
 			     16, 16, 0,
-			     t[i].internal_format, t[i].type, buffer);
+			     t[i].internal_format, t[i].type, NULL);
 #if defined(PIGLIT_USE_OPENGL_ES1) || defined(PIGLIT_USE_OPENGL_ES2)
 		{
 			GLenum error = glGetError();
@@ -131,13 +130,13 @@ piglit_init(int argc, char **argv)
 		 */
 		glCompressedTexImage2D(GL_TEXTURE_2D, 0, t[i].internal_format,
 					  16, 16, 0,
-					  size + t[i].palette_size - 1, buffer);
+					  size + t[i].palette_size - 1, NULL);
 		if (!piglit_check_gl_error(GL_INVALID_VALUE))
 			piglit_report_result(PIGLIT_FAIL);
 
 		glCompressedTexImage2D(GL_TEXTURE_2D, 0, t[i].internal_format,
 					  16, 16, 0,
-					  size + t[i].palette_size, buffer);
+					  size + t[i].palette_size, NULL);
 		if (!piglit_check_gl_error(GL_NO_ERROR))
 			piglit_report_result(PIGLIT_FAIL);
 
@@ -155,7 +154,7 @@ piglit_init(int argc, char **argv)
 		size = (8 * 8) >> t[i].shift;
 		glCompressedTexImage2D(GL_TEXTURE_2D, 1, t[i].internal_format,
 				       8, 8, 0,
-				       size + t[i].palette_size, buffer);
+				       size + t[i].palette_size, NULL);
 		if (!piglit_check_gl_error(GL_INVALID_VALUE))
 			piglit_report_result(PIGLIT_FAIL);
 
@@ -184,7 +183,7 @@ piglit_init(int argc, char **argv)
 		size = (17 * 17) >> t[i].shift;
 		glCompressedTexImage2D(GL_TEXTURE_2D, 0, t[i].internal_format,
 				       16, 16, 1,
-				       size + t[i].palette_size, buffer);
+				       size + t[i].palette_size, NULL);
 #if defined(PIGLIT_USE_OPENGL_ES1) || defined(PIGLIT_USE_OPENGL_ES2)
 		if (!piglit_check_gl_error(GL_INVALID_VALUE))
 			piglit_report_result(PIGLIT_FAIL);
-- 
2.4.2



More information about the Piglit mailing list