Module: Mesa
Branch: asm-shader-rework-1
Commit: 17534ab88ce29119f79de8abfcc4170471e8f5a4
URL:    
http://cgit.freedesktop.org/mesa/mesa/commit/?id=17534ab88ce29119f79de8abfcc4170471e8f5a4

Author: Ian Romanick <ian.d.roman...@intel.com>
Date:   Thu Jul 30 09:41:35 2009 -0700

ARB prog parser: Prevent NULL ptr deref for KIL instruction

The KIL instruction doesn't have a destination register, so
dereferencing dst in asm_instruction_ctor would cause a segfault.

---

 src/mesa/shader/program_parse.tab.c |   10 +++++++++-
 src/mesa/shader/program_parse.y     |   10 +++++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/src/mesa/shader/program_parse.tab.c 
b/src/mesa/shader/program_parse.tab.c
index 1d07198..9b4c4e8 100644
--- a/src/mesa/shader/program_parse.tab.c
+++ b/src/mesa/shader/program_parse.tab.c
@@ -4748,7 +4748,15 @@ asm_instruction_ctor(gl_inst_opcode op,
    if (inst) {
       _mesa_init_instructions(& inst->Base, 1);
       inst->Base.Opcode = op;
-      inst->Base.DstReg = *dst;
+
+      /* In the core ARB extensions only the KIL instruction doesn't have a
+       * destination register.
+       */
+      if (dst == NULL) {
+        init_dst_reg(& inst->Base.DstReg);
+      } else {
+        inst->Base.DstReg = *dst;
+      }
 
       inst->Base.SrcReg[0] = src0->Base;
       inst->SrcReg[0] = *src0;
diff --git a/src/mesa/shader/program_parse.y b/src/mesa/shader/program_parse.y
index 9a5907a..1a214b3 100644
--- a/src/mesa/shader/program_parse.y
+++ b/src/mesa/shader/program_parse.y
@@ -1879,7 +1879,15 @@ asm_instruction_ctor(gl_inst_opcode op,
    if (inst) {
       _mesa_init_instructions(& inst->Base, 1);
       inst->Base.Opcode = op;
-      inst->Base.DstReg = *dst;
+
+      /* In the core ARB extensions only the KIL instruction doesn't have a
+       * destination register.
+       */
+      if (dst == NULL) {
+        init_dst_reg(& inst->Base.DstReg);
+      } else {
+        inst->Base.DstReg = *dst;
+      }
 
       inst->Base.SrcReg[0] = src0->Base;
       inst->SrcReg[0] = *src0;

_______________________________________________
mesa-commit mailing list
mesa-commit@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/mesa-commit

Reply via email to