On Wed, Mar 12, 2014 at 1:24 PM, Emil Velikov <emil.l.veli...@gmail.com> wrote:
> Commit 3805a864b1d(nv50: assert before trying to out-of-bounds access
> samplers) introduced a series of asserts as a precausion of a previous
> illegal memory access.
>
> Although it failed to encapsulate loop within nv50_sampler_state_delete
> effectively failing to clear the sampler state, apart from exadurating
> the illegal memory access issue.
>
> Fixes gcc warning "array subscript is above array bounds" and
> "Nesting level does not match indentation" and "Out-of-bounds read"
> defects reported by Coverity.
>
> Cc: "10.1" <mesa-sta...@lists.freedesktop.org>
> Signed-off-by: Emil Velikov <emil.l.veli...@gmail.com>
Reviewed-by: Ilia Mirkin <imir...@alum.mit.edu>
> ---
> src/gallium/drivers/nouveau/nv50/nv50_state.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/src/gallium/drivers/nouveau/nv50/nv50_state.c
> b/src/gallium/drivers/nouveau/nv50/nv50_state.c
> index 862636b..647c01f 100644
> --- a/src/gallium/drivers/nouveau/nv50/nv50_state.c
> +++ b/src/gallium/drivers/nouveau/nv50/nv50_state.c
> @@ -558,11 +558,12 @@ nv50_sampler_state_delete(struct pipe_context *pipe,
> void *hwcso)
> {
> unsigned s, i;
>
> - for (s = 0; s < 3; ++s)
> + for (s = 0; s < 3; ++s) {
> assert(nv50_context(pipe)->num_samplers[s] <= PIPE_MAX_SAMPLERS);
> for (i = 0; i < nv50_context(pipe)->num_samplers[s]; ++i)
> if (nv50_context(pipe)->samplers[s][i] == hwcso)
> nv50_context(pipe)->samplers[s][i] = NULL;
> + }
>
> nv50_screen_tsc_free(nv50_context(pipe)->screen, nv50_tsc_entry(hwcso));
>
> --
> 1.9.0
>
> _______________________________________________
> mesa-dev mailing list
> mesa-dev@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/mesa-dev
_______________________________________________
mesa-dev mailing list
mesa-dev@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/mesa-dev
