File 0008-28894a30-gallium-tgsi-fix-oob-access-in-pa... of Package virglrenderer

Overview Repositories Revisions Requests Users Attributes Meta

File 0008-28894a30-gallium-tgsi-fix-oob-access-in-parse-instruction.patch of Package virglrenderer

From 28894a30a17a84529be102b21118e55d6c9f23fa Mon Sep 17 00:00:00 2001
From: Li Qiang <liq3ea@gmail.com>
Date: Mon, 23 Jan 2017 02:44:03 -0500
Subject: [PATCH] gallium/tgsi: fix oob access in parse instruction

When parsing texture instruction, it doesn't stop if the
'cur' is ',', the loop variable 'i' will also be increased
and be used to index the 'inst.TexOffsets' array. This can lead
an oob access issue. This patch avoid this.

Signed-off-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Index: virglrenderer-0.5.0/src/gallium/auxiliary/tgsi/tgsi_text.c
===================================================================
--- virglrenderer-0.5.0.orig/src/gallium/auxiliary/tgsi/tgsi_text.c
+++ virglrenderer-0.5.0/src/gallium/auxiliary/tgsi/tgsi_text.c
@@ -1094,7 +1094,7 @@ parse_instruction(
 
    cur = ctx->cur;
    eat_opt_white( &cur );
-   for (i = 0; inst.Instruction.Texture && *cur == ','; i++) {
+   for (i = 0; inst.Instruction.Texture && *cur == ',' && i < TGSI_FULL_MAX_TEX_OFFSETS; i++) {
          cur++;
          eat_opt_white( &cur );
          ctx->cur = cur;

Places

File 0008-28894a30-gallium-tgsi-fix-oob-access-in-parse-instruction.patch of Package virglrenderer

Places