[Piglit] [PATCH] fbo-readpixels-oob: Add a glReadPixels out-of-bounds test

[Brian Paul]

On 02/12/2016 03:24 PM, Nanley Chery wrote:
> From: Nanley Chery <nanley.g.chery at intel.com>
>
> Test that glReadPixels for an area which reaches out of bounds
> behaves like a glReadPixels into a subrectangle for the valid area.
> This behaviour reduces the number of corner cases associated with
> this function.
>
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92193
>
> Signed-off-by: Nanley Chery <nanley.g.chery at intel.com>
> ---
>   tests/all.py                   |   1 +
>   tests/fbo/CMakeLists.gl.txt    |   1 +
>   tests/fbo/fbo-readpixels-oob.c | 122 +++++++++++++++++++++++++++++++++++++++++

This test isn't really specific to FBOs.  How about putting it under 
tests/spec/gl-1.0/readpixels-oob.c ?


>   3 files changed, 124 insertions(+)
>   create mode 100644 tests/fbo/fbo-readpixels-oob.c
>
> diff --git a/tests/all.py b/tests/all.py
> index 89288a2..71addfc 100644
> --- a/tests/all.py
> +++ b/tests/all.py
> @@ -2987,6 +2987,7 @@ with profile.group_manager(
>       g(['fbo-nodepth-test'])
>       g(['fbo-nostencil-test'])
>       g(['fbo-readpixels'])
> +    g(['fbo-readpixels-oob'])
>       g(['fbo-readpixels-depth-formats'])
>       g(['fbo-scissor-bitmap'])
>       g(['fbo-storage-completeness'])
> diff --git a/tests/fbo/CMakeLists.gl.txt b/tests/fbo/CMakeLists.gl.txt
> index 0476b10..6a33af8 100644
> --- a/tests/fbo/CMakeLists.gl.txt
> +++ b/tests/fbo/CMakeLists.gl.txt
> @@ -77,6 +77,7 @@ piglit_add_executable (fbo-mrt-new-bind fbo-mrt-new-bind.c)
>   piglit_add_executable (fbo-nodepth-test fbo-nodepth-test.c)
>   piglit_add_executable (fbo-nostencil-test fbo-nostencil-test.c)
>   piglit_add_executable (fbo-readpixels fbo-readpixels.c)
> +piglit_add_executable (fbo-readpixels-oob fbo-readpixels-oob.c)
>   piglit_add_executable (fbo-readpixels-depth-formats fbo-readpixels-depth-formats.c)
>   piglit_add_executable (fbo-rg fbo-rg.c)
>   piglit_add_executable (fbo-scissor-blit fbo-scissor-blit.c)
> diff --git a/tests/fbo/fbo-readpixels-oob.c b/tests/fbo/fbo-readpixels-oob.c
> new file mode 100644
> index 0000000..19d4dd4
> --- /dev/null
> +++ b/tests/fbo/fbo-readpixels-oob.c
> @@ -0,0 +1,122 @@
> +/*
> + * Copyright © 2016 Intel Corporation
> + *
> + * Permission is hereby granted, free of charge, to any person obtaining a
> + * copy of this software and associated documentation files (the "Software"),
> + * to deal in the Software without restriction, including without limitation
> + * the rights to use, copy, modify, merge, publish, distribute, sublicense,
> + * and/or sell copies of the Software, and to permit persons to whom the
> + * Software is furnished to do so, subject to the following conditions:
> + *
> + * The above copyright notice and this permission notice (including the next
> + * paragraph) shall be included in all copies or substantial portions of the
> + * Software.
> + *
> + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
> + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
> + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
> + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
> + * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
> + * IN THE SOFTWARE.
> + *
> + */
> +
> +/** @file fbo-readpixels-oob.c
> + *
> + * Test that requesting an area larger than the readbuffer (with
> + * glReadPixels) will only modify the valid area in the user's buffer.
> + * This is equivalent to a user requesting to read into a sub-rectangle
> + * of the larger rectangle contained in the provided buffer (via
> + * PACK_ROW_LENGTH, PACK_SKIP_ROWS, PACK_SKIP_PIXELS).

Actually, is that really true?  The spec says "If any of these pixels 
lies outside of the window allocated to the current GL context, or 
outside of the image attached to the currently bound read framebuffer 
object, then the values obtained for those pixels are undefined."

It doesn't say those pixels will be untouched in the destination buffer.

That said, I'd bet all OpenGL drivers do clipping as we do in Mesa so 
this test is probably fine.  Reading pixels from out of bounds regions 
could be viewed as a security issue.  In theory, you could be reading 
graphics memory that previously was allocated by some other user and may 
contain sensitive information.  Same thing for something like 
glGetTexImage() from an uninitialized texture.  We're sensitive to this 
sort of thing where multiple VMs may be sharing a GPU and its memory.


> + *
> + * This behaviour ensures that Mesa does as little work as possible in
> + * this imprecise usage of glReadpixels. It also reduces the bugs that
> + * may occur with this special case by converting it to an analogous
> + * common case.
> + *
> + */
> +
> +#include "piglit-util-gl.h"
> +
> +#define BUF_WIDTH 64
> +#define BUF_HEIGHT 64
> +#define BIG_MULT 4
> +#define BIG_BUF_WIDTH (BIG_MULT * BUF_WIDTH)
> +#define BIG_BUF_HEIGHT (BIG_MULT * BUF_HEIGHT)
> +
> +
> +PIGLIT_GL_TEST_CONFIG_BEGIN
> +
> +	config.supports_gl_compat_version = 10;
> +	config.window_width = BUF_WIDTH;
> +	config.window_height = BUF_HEIGHT;

Can we use a larget window size?  On Windows, if you create a window 
that's too small it'll get resized to some minimum and that confuses 
piglit.  See the comment in piglit_gl_test_config_init().

I think BIG_BUF_WIDTH, etc could be computed at runtime as BIG_MULT * 
piglit_width, etc.




> +	config.window_visual = PIGLIT_GL_VISUAL_DOUBLE | PIGLIT_GL_VISUAL_RGBA;
> +
> +PIGLIT_GL_TEST_CONFIG_END
> +
> +static GLboolean

Nowadays we'd use bool/true/false instead of GLboolean/GL_TRUE/GL_FALSE.


> +test_with_format(GLenum internal_format, GLenum format,
> +		 float results_x, float results_y)

results_x and results_y don't seem to be used in the function.


> +{
> +	GLboolean pass = GL_TRUE;
> +	int x, y;
> +	int i;
> +
> +	/* Allocate into an oversized buffer. We'll check that the contents
> +	 * are still 0 after the glReadPixels.
> +	 */
> +	const size_t num_chan = 4;
> +	const size_t tot_elements = BIG_BUF_HEIGHT * BIG_BUF_WIDTH * num_chan;
> +	GLubyte * black_img = (GLubyte*)calloc(tot_elements, sizeof(GLubyte));
> +	GLfloat * black_imgf = (GLfloat*)malloc(tot_elements *sizeof(GLfloat));
> +
> +	/* Clear background to purple */
> +	glClearColor(1.0, 0.0, 1.0, 0.0);
> +	glClear(GL_COLOR_BUFFER_BIT);
> +
> +	/* Perform over-sized glReadPixels. Read the readbuffer as
> +	 * GLubytes in order to hit most HW fast-paths.
> +	 */
> +	glReadPixels(0, 0, BIG_BUF_WIDTH, BIG_BUF_HEIGHT, GL_RGBA,
> +			GL_UNSIGNED_BYTE, black_img);
> +
> +	/* Convert values to float in order to use utility comparison function.
> +	 */
> +	for (i = 0; i < tot_elements; i++)
> +		black_imgf[i] = black_img[i] / 255.0;
> +
> +	/* Confirm the result */
> +	for (y = 0; y < BIG_BUF_HEIGHT; y++) {
> +		for (x = 0; x < BIG_BUF_WIDTH; x++) {
> +			static const GLfloat valid_pixel[4] = {1.0, 0, 1.0, 0};
> +			static const GLfloat invalid_pixel[4] = {0};
> +			const unsigned index = y * BIG_BUF_WIDTH * num_chan +
> +						x * num_chan;
> +			const GLfloat * expected_pixel =
> +					(x < BUF_WIDTH && y < BUF_HEIGHT) ?
> +						valid_pixel : invalid_pixel;
> +
> +			pass &= piglit_compare_pixels(x, y, expected_pixel,
> +						      black_imgf + index,
> +						      piglit_tolerance,
> +						      num_chan);
> +			if (!pass)
> +				return GL_FALSE;
> +		}
> +	}

free(black_img);
free(black_imgf);

Just to be complete.

> +
> +	return pass;
> +}
> +
> +enum piglit_result
> +piglit_display(void)
> +{
> +	GLboolean pass = test_with_format(GL_RGBA8, GL_BGRA, 0, 0);
> +	piglit_present_results();
> +	return pass ? PIGLIT_PASS : PIGLIT_FAIL;
> +}
> +
> +void piglit_init(int argc, char **argv)
> +{
> +}
>

It might be nice if this test also called glReadPixels() with a negative 
x, y position.  That would exercise more of the clipping code.

-Brian