[Mesa-dev] [PATCH 2/6] glsl_to_tgsi: fix out-of-bounds constant access and crash for uniforms

Marek Olšák maraeo at gmail.com
Sat Apr 11 12:12:30 PDT 2015


From: Marek Olšák <marek.olsak at amd.com>

This fixes piglit shaders at glsl-fs-uniform-array-loop-unroll with immediate
shader compilation - it's a compiler test, so it has never been translated
to TGSI before.

Cc: 10.4 10.5 <mesa-stable at lists.freedesktop.org>
---
 src/mesa/state_tracker/st_glsl_to_tgsi.cpp | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/mesa/state_tracker/st_glsl_to_tgsi.cpp b/src/mesa/state_tracker/st_glsl_to_tgsi.cpp
index 5fa7a41..8a53d80 100644
--- a/src/mesa/state_tracker/st_glsl_to_tgsi.cpp
+++ b/src/mesa/state_tracker/st_glsl_to_tgsi.cpp
@@ -4346,6 +4346,7 @@ struct st_translate {
 
    struct ureg_dst arrays[MAX_ARRAYS];
    struct ureg_src *constants;
+   int num_constants;
    struct ureg_src *immediates;
    struct ureg_dst outputs[PIPE_MAX_SHADER_OUTPUTS];
    struct ureg_src inputs[PIPE_MAX_SHADER_INPUTS];
@@ -4556,15 +4557,15 @@ src_register(struct st_translate *t, const st_src_reg *reg)
 
    case PROGRAM_UNIFORM:
       assert(reg->index >= 0);
-      return t->constants[reg->index];
+      return reg->index < t->num_constants ?
+               t->constants[reg->index] : ureg_imm4f(t->ureg, 0, 0, 0, 0);
    case PROGRAM_STATE_VAR:
    case PROGRAM_CONSTANT:       /* ie, immediate */
       if (reg->has_index2)
          return ureg_src_register(TGSI_FILE_CONSTANT, reg->index);
-      else if (reg->index < 0)
-         return ureg_DECL_constant(t->ureg, 0);
       else
-         return t->constants[reg->index];
+         return reg->index >= 0 && reg->index < t->num_constants ?
+                  t->constants[reg->index] : ureg_imm4f(t->ureg, 0, 0, 0, 0);
 
    case PROGRAM_IMMEDIATE:
       return t->immediates[reg->index];
@@ -5282,6 +5283,7 @@ st_translate_program(
          ret = PIPE_ERROR_OUT_OF_MEMORY;
          goto out;
       }
+      t->num_constants = proginfo->Parameters->NumParameters;
 
       for (i = 0; i < proginfo->Parameters->NumParameters; i++) {
          switch (proginfo->Parameters->Parameters[i].Type) {
@@ -5382,6 +5384,7 @@ out:
       free(t->insn);
       free(t->labels);
       free(t->constants);
+      t->num_constants = 0;
       free(t->immediates);
 
       if (t->error) {
-- 
2.1.0



More information about the mesa-dev mailing list