[Piglit] [PATCH] fbo-readpixels-oob: Add a glReadPixels out-of-bounds test
Nanley Chery
nanleychery at gmail.com
Wed Feb 17 01:17:09 UTC 2016
On Sat, Feb 13, 2016 at 10:26:49AM -0700, Brian Paul wrote:
> On 02/12/2016 03:24 PM, Nanley Chery wrote:
> >From: Nanley Chery <nanley.g.chery at intel.com>
> >
> >Test that glReadPixels for an area which reaches out of bounds
> >behaves like a glReadPixels into a subrectangle for the valid area.
> >This behaviour reduces the number of corner cases associated with
> >this function.
> >
> >Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92193
> >
> >Signed-off-by: Nanley Chery <nanley.g.chery at intel.com>
> >---
> > tests/all.py | 1 +
> > tests/fbo/CMakeLists.gl.txt | 1 +
> > tests/fbo/fbo-readpixels-oob.c | 122 +++++++++++++++++++++++++++++++++++++++++
>
> This test isn't really specific to FBOs. How about putting it under
> tests/spec/gl-1.0/readpixels-oob.c ?
>
Sounds good. I had originally based this test off the fbo-readpixels test,
but it has changed to the point where FBOs aren't the focus.
>
> > 3 files changed, 124 insertions(+)
> > create mode 100644 tests/fbo/fbo-readpixels-oob.c
> >
> >diff --git a/tests/all.py b/tests/all.py
> >index 89288a2..71addfc 100644
> >--- a/tests/all.py
> >+++ b/tests/all.py
> >@@ -2987,6 +2987,7 @@ with profile.group_manager(
> > g(['fbo-nodepth-test'])
> > g(['fbo-nostencil-test'])
> > g(['fbo-readpixels'])
> >+ g(['fbo-readpixels-oob'])
> > g(['fbo-readpixels-depth-formats'])
> > g(['fbo-scissor-bitmap'])
> > g(['fbo-storage-completeness'])
> >diff --git a/tests/fbo/CMakeLists.gl.txt b/tests/fbo/CMakeLists.gl.txt
> >index 0476b10..6a33af8 100644
> >--- a/tests/fbo/CMakeLists.gl.txt
> >+++ b/tests/fbo/CMakeLists.gl.txt
> >@@ -77,6 +77,7 @@ piglit_add_executable (fbo-mrt-new-bind fbo-mrt-new-bind.c)
> > piglit_add_executable (fbo-nodepth-test fbo-nodepth-test.c)
> > piglit_add_executable (fbo-nostencil-test fbo-nostencil-test.c)
> > piglit_add_executable (fbo-readpixels fbo-readpixels.c)
> >+piglit_add_executable (fbo-readpixels-oob fbo-readpixels-oob.c)
> > piglit_add_executable (fbo-readpixels-depth-formats fbo-readpixels-depth-formats.c)
> > piglit_add_executable (fbo-rg fbo-rg.c)
> > piglit_add_executable (fbo-scissor-blit fbo-scissor-blit.c)
> >diff --git a/tests/fbo/fbo-readpixels-oob.c b/tests/fbo/fbo-readpixels-oob.c
> >new file mode 100644
> >index 0000000..19d4dd4
> >--- /dev/null
> >+++ b/tests/fbo/fbo-readpixels-oob.c
> >@@ -0,0 +1,122 @@
> >+/*
> >+ * Copyright © 2016 Intel Corporation
> >+ *
> >+ * Permission is hereby granted, free of charge, to any person obtaining a
> >+ * copy of this software and associated documentation files (the "Software"),
> >+ * to deal in the Software without restriction, including without limitation
> >+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
> >+ * and/or sell copies of the Software, and to permit persons to whom the
> >+ * Software is furnished to do so, subject to the following conditions:
> >+ *
> >+ * The above copyright notice and this permission notice (including the next
> >+ * paragraph) shall be included in all copies or substantial portions of the
> >+ * Software.
> >+ *
> >+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
> >+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> >+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
> >+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
> >+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
> >+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
> >+ * IN THE SOFTWARE.
> >+ *
> >+ */
> >+
> >+/** @file fbo-readpixels-oob.c
> >+ *
> >+ * Test that requesting an area larger than the readbuffer (with
> >+ * glReadPixels) will only modify the valid area in the user's buffer.
> >+ * This is equivalent to a user requesting to read into a sub-rectangle
> >+ * of the larger rectangle contained in the provided buffer (via
> >+ * PACK_ROW_LENGTH, PACK_SKIP_ROWS, PACK_SKIP_PIXELS).
>
> Actually, is that really true? The spec says "If any of these pixels lies
> outside of the window allocated to the current GL context, or outside of the
> image attached to the currently bound read framebuffer object, then the
> values obtained for those pixels are undefined."
>
> It doesn't say those pixels will be untouched in the destination buffer.
I forgot that Piglit aims to be driver agnostic. I wrote this test
specifically to test Mesa behavior. You're right that the spec
allows undefined data to be returned.
>
> That said, I'd bet all OpenGL drivers do clipping as we do in Mesa so this
> test is probably fine. Reading pixels from out of bounds regions could be
> viewed as a security issue. In theory, you could be reading graphics memory
> that previously was allocated by some other user and may contain sensitive
> information. Same thing for something like glGetTexImage() from an
> uninitialized texture. We're sensitive to this sort of thing where multiple
> VMs may be sharing a GPU and its memory.
>
>
Thank you for the feedback. If this becomes an issue with other OpenGL
implementations, I'll deal with it when it comes up. It would be nice
to have a place to put Mesa-specific piglit tests.
I've considered the security implications of this issue. Would the
kernel provide some protection in the form of segfaults since the user
would be reading in memory not provided to the process?
> >+ *
> >+ * This behaviour ensures that Mesa does as little work as possible in
> >+ * this imprecise usage of glReadpixels. It also reduces the bugs that
> >+ * may occur with this special case by converting it to an analogous
> >+ * common case.
> >+ *
> >+ */
> >+
> >+#include "piglit-util-gl.h"
> >+
> >+#define BUF_WIDTH 64
> >+#define BUF_HEIGHT 64
> >+#define BIG_MULT 4
> >+#define BIG_BUF_WIDTH (BIG_MULT * BUF_WIDTH)
> >+#define BIG_BUF_HEIGHT (BIG_MULT * BUF_HEIGHT)
> >+
> >+
> >+PIGLIT_GL_TEST_CONFIG_BEGIN
> >+
> >+ config.supports_gl_compat_version = 10;
> >+ config.window_width = BUF_WIDTH;
> >+ config.window_height = BUF_HEIGHT;
>
> Can we use a larget window size? On Windows, if you create a window that's
> too small it'll get resized to some minimum and that confuses piglit. See
> the comment in piglit_gl_test_config_init().
>
> I think BIG_BUF_WIDTH, etc could be computed at runtime as BIG_MULT *
> piglit_width, etc.
>
>
Sounds good. I'll use the default.
>
>
> >+ config.window_visual = PIGLIT_GL_VISUAL_DOUBLE | PIGLIT_GL_VISUAL_RGBA;
> >+
> >+PIGLIT_GL_TEST_CONFIG_END
> >+
> >+static GLboolean
>
> Nowadays we'd use bool/true/false instead of GLboolean/GL_TRUE/GL_FALSE.
>
Fixed locally.
>
> >+test_with_format(GLenum internal_format, GLenum format,
> >+ float results_x, float results_y)
>
> results_x and results_y don't seem to be used in the function.
>
I'll remove the arguments.
>
> >+{
> >+ GLboolean pass = GL_TRUE;
> >+ int x, y;
> >+ int i;
> >+
> >+ /* Allocate into an oversized buffer. We'll check that the contents
> >+ * are still 0 after the glReadPixels.
> >+ */
> >+ const size_t num_chan = 4;
> >+ const size_t tot_elements = BIG_BUF_HEIGHT * BIG_BUF_WIDTH * num_chan;
> >+ GLubyte * black_img = (GLubyte*)calloc(tot_elements, sizeof(GLubyte));
> >+ GLfloat * black_imgf = (GLfloat*)malloc(tot_elements *sizeof(GLfloat));
> >+
> >+ /* Clear background to purple */
> >+ glClearColor(1.0, 0.0, 1.0, 0.0);
> >+ glClear(GL_COLOR_BUFFER_BIT);
> >+
> >+ /* Perform over-sized glReadPixels. Read the readbuffer as
> >+ * GLubytes in order to hit most HW fast-paths.
> >+ */
> >+ glReadPixels(0, 0, BIG_BUF_WIDTH, BIG_BUF_HEIGHT, GL_RGBA,
> >+ GL_UNSIGNED_BYTE, black_img);
> >+
> >+ /* Convert values to float in order to use utility comparison function.
> >+ */
> >+ for (i = 0; i < tot_elements; i++)
> >+ black_imgf[i] = black_img[i] / 255.0;
> >+
> >+ /* Confirm the result */
> >+ for (y = 0; y < BIG_BUF_HEIGHT; y++) {
> >+ for (x = 0; x < BIG_BUF_WIDTH; x++) {
> >+ static const GLfloat valid_pixel[4] = {1.0, 0, 1.0, 0};
> >+ static const GLfloat invalid_pixel[4] = {0};
> >+ const unsigned index = y * BIG_BUF_WIDTH * num_chan +
> >+ x * num_chan;
> >+ const GLfloat * expected_pixel =
> >+ (x < BUF_WIDTH && y < BUF_HEIGHT) ?
> >+ valid_pixel : invalid_pixel;
> >+
> >+ pass &= piglit_compare_pixels(x, y, expected_pixel,
> >+ black_imgf + index,
> >+ piglit_tolerance,
> >+ num_chan);
> >+ if (!pass)
> >+ return GL_FALSE;
> >+ }
> >+ }
>
> free(black_img);
> free(black_imgf);
>
> Just to be complete.
Good catch. I've put the frees after a goto label.
>
> >+
> >+ return pass;
> >+}
> >+
> >+enum piglit_result
> >+piglit_display(void)
> >+{
> >+ GLboolean pass = test_with_format(GL_RGBA8, GL_BGRA, 0, 0);
> >+ piglit_present_results();
> >+ return pass ? PIGLIT_PASS : PIGLIT_FAIL;
> >+}
> >+
> >+void piglit_init(int argc, char **argv)
> >+{
> >+}
> >
>
> It might be nice if this test also called glReadPixels() with a negative x,
> y position. That would exercise more of the clipping code.
>
I'm adding more coverage to this test. I initially thought negative
x & y's would've returned an GL error, but I now see that isn't the
case.
Thanks,
Nanley
> -Brian
>
More information about the Piglit
mailing list