Commit: bc6bbe5fac864ded3a00f4a50d5eb79f89b74c75
Author: Stefan Werner
Date: Sun Mar 8 21:31:47 2020 +0100
Branches: master
https://developer.blender.org/rBbc6bbe5fac864ded3a00f4a50d5eb79f89b74c75
Fix T74537: Fixed out of bounds memory access in Cycles' PMJ sampler.
===================================================================
M intern/cycles/kernel/kernel_jitter.h
===================================================================
diff --git a/intern/cycles/kernel/kernel_jitter.h
b/intern/cycles/kernel/kernel_jitter.h
index b733bb9fee2..5b6e3bbf501 100644
--- a/intern/cycles/kernel/kernel_jitter.h
+++ b/intern/cycles/kernel/kernel_jitter.h
@@ -198,7 +198,7 @@ ccl_device void cmj_sample_2D(int s, int N, int p, float
*fx, float *fy)
ccl_device float pmj_sample_1D(KernelGlobals *kg, int sample, int rng_hash,
int dimension)
{
/* Fallback to random */
- if (sample > NUM_PMJ_SAMPLES) {
+ if (sample >= NUM_PMJ_SAMPLES) {
int p = rng_hash + dimension;
return cmj_randfloat(sample, p);
}
@@ -211,10 +211,11 @@ ccl_device float pmj_sample_1D(KernelGlobals *kg, int
sample, int rng_hash, int
ccl_device void pmj_sample_2D(
KernelGlobals *kg, int sample, int rng_hash, int dimension, float *fx,
float *fy)
{
- if (sample > NUM_PMJ_SAMPLES) {
+ if (sample >= NUM_PMJ_SAMPLES) {
int p = rng_hash + dimension;
*fx = cmj_randfloat(sample, p);
*fy = cmj_randfloat(sample, p + 1);
+ return;
}
uint tmp_rng = cmj_hash_simple(dimension, rng_hash);
int index = ((dimension % NUM_PMJ_PATTERNS) * NUM_PMJ_SAMPLES + sample) * 2;
_______________________________________________
Bf-blender-cvs mailing list
[email protected]
https://lists.blender.org/mailman/listinfo/bf-blender-cvs
