Module: Mesa
Branch: master
Commit: b9b9540a604883e620de872537b89d47d4bceb68
URL:    
http://cgit.freedesktop.org/mesa/mesa/commit/?id=b9b9540a604883e620de872537b89d47d4bceb68

Author: Marek Olšák <marek.ol...@amd.com>
Date:   Tue Jan 17 21:49:50 2017 +0100

radeonsi: reject invalid vertex buffer indices at state creation

Reviewed-by: Nicolai Hähnle <nicolai.haeh...@amd.com>

---

 src/gallium/drivers/radeonsi/si_descriptors.c | 5 -----
 src/gallium/drivers/radeonsi/si_state.c       | 6 ++++++
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/gallium/drivers/radeonsi/si_descriptors.c 
b/src/gallium/drivers/radeonsi/si_descriptors.c
index 0a49c87..5635621 100644
--- a/src/gallium/drivers/radeonsi/si_descriptors.c
+++ b/src/gallium/drivers/radeonsi/si_descriptors.c
@@ -970,11 +970,6 @@ bool si_upload_vertex_buffer_descriptors(struct si_context 
*sctx)
                unsigned offset;
                uint32_t *desc = &ptr[i*4];
 
-               if (ve->vertex_buffer_index >= ARRAY_SIZE(sctx->vertex_buffer)) 
{
-                       memset(desc, 0, 16);
-                       continue;
-               }
-
                vb = &sctx->vertex_buffer[ve->vertex_buffer_index];
                rbuffer = (struct r600_resource*)vb->buffer;
                if (!rbuffer) {
diff --git a/src/gallium/drivers/radeonsi/si_state.c 
b/src/gallium/drivers/radeonsi/si_state.c
index 4aa1cd7..3022260 100644
--- a/src/gallium/drivers/radeonsi/si_state.c
+++ b/src/gallium/drivers/radeonsi/si_state.c
@@ -3335,6 +3335,12 @@ static void *si_create_vertex_elements(struct 
pipe_context *ctx,
                const struct util_format_channel_description *channel;
                unsigned data_format, num_format;
                int first_non_void;
+               unsigned vbo_index = elements[i].vertex_buffer_index;
+
+               if (vbo_index >= SI_NUM_VERTEX_BUFFERS) {
+                       FREE(v);
+                       return NULL;
+               }
 
                desc = util_format_description(elements[i].src_format);
                first_non_void = 
util_format_get_first_non_void_channel(elements[i].src_format);

_______________________________________________
mesa-commit mailing list
mesa-commit@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/mesa-commit

Reply via email to