[Mesa-dev] [PATCH] gallium/radeon: don't crash when getting out-of-bounds TEMP references

[Michel Dänzer]

On 12.04.2015 04:11, Marek Olšák wrote:
> From: Marek Olšák <marek.olsak at amd.com>
> 
> ---
>  src/gallium/drivers/radeon/radeon_setup_tgsi_llvm.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/src/gallium/drivers/radeon/radeon_setup_tgsi_llvm.c b/src/gallium/drivers/radeon/radeon_setup_tgsi_llvm.c
> index 1690194..333f7ae 100644
> --- a/src/gallium/drivers/radeon/radeon_setup_tgsi_llvm.c
> +++ b/src/gallium/drivers/radeon/radeon_setup_tgsi_llvm.c
> @@ -191,6 +191,8 @@ emit_fetch(
>  		break;
>  
>  	case TGSI_FILE_TEMPORARY:
> +		if (reg->Register.Index >= ctx->temps_count)
> +			return LLVMGetUndef(tgsi2llvmtype(bld_base, type));
>  		if (uses_temp_indirect_addressing(bld_base)) {
>  			ptr = lp_get_temp_ptr_soa(bld, reg->Register.Index, swizzle);
>  			break;
> @@ -395,6 +397,8 @@ emit_store(
>  					break;
>  
>  				case TGSI_FILE_TEMPORARY:
> +					if (range.First + i >= ctx->temps_count)
> +						continue;
>  					if (uses_temp_indirect_addressing(bld_base))
>  						temp_ptr = lp_get_temp_ptr_soa(bld, i + range.First, chan_index);
>  					else
> @@ -416,6 +420,8 @@ emit_store(
>  				break;
>  
>  			case TGSI_FILE_TEMPORARY:
> +				if (reg->Register.Index >= ctx->temps_count)
> +					continue;
>  				if (uses_temp_indirect_addressing(bld_base)) {
>  					temp_ptr = NULL;
>  					break;
> 

Looks good to me, but Tom should probably also take a look.


-- 
Earthling Michel Dänzer               |               http://www.amd.com
Libre software enthusiast             |             Mesa and X developer