Module: Mesa Branch: master Commit: 4668cd30d974d401eb5d5f1cd294c4210af63990 URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=4668cd30d974d401eb5d5f1cd294c4210af63990
Author: Pierre-Eric Pelloux-Prayer <[email protected]> Date: Thu Mar 11 21:54:36 2021 +0100 radeonsi/sqtt: fix user event max size Larger strings can corrupt rgp files. Fixes: 5dc823304b1 ("radeonsi/sqtt: forward string markers to sqtt") Reviewed-by: Zoltán Böszörményi <[email protected]> Reviewed-by: James Zhu <[email protected]> Reviewed-by: Boyuan Zhang <[email protected]> Reviewed-by: Marek Olšák <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/9553> --- src/gallium/drivers/radeonsi/si_sqtt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/gallium/drivers/radeonsi/si_sqtt.c b/src/gallium/drivers/radeonsi/si_sqtt.c index b6c10ba5c8b..dcd40c12913 100644 --- a/src/gallium/drivers/radeonsi/si_sqtt.c +++ b/src/gallium/drivers/radeonsi/si_sqtt.c @@ -828,12 +828,13 @@ si_write_user_event(struct si_context* sctx, struct radeon_cmdbuf *rcs, struct rgp_sqtt_marker_user_event_with_length marker = { 0 }; marker.user_event.identifier = RGP_SQTT_MARKER_IDENTIFIER_USER_EVENT; marker.user_event.data_type = type; + len = MIN2(1024, len); marker.length = align(len, 4); uint8_t *buffer = alloca(sizeof(marker) + marker.length); - memset(buffer, 0, sizeof(marker) + marker.length); memcpy(buffer, &marker, sizeof(marker)); memcpy(buffer + sizeof(marker), str, len); + buffer[sizeof(marker) + len - 1] = '\0'; si_emit_thread_trace_userdata(sctx, rcs, buffer, sizeof(marker) / 4 + marker.length / 4); } _______________________________________________ mesa-commit mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/mesa-commit
