Module: Mesa Branch: main Commit: ce5d7bf5085de668d3203f922822f71d4bc0d6b2 URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=ce5d7bf5085de668d3203f922822f71d4bc0d6b2
Author: Samuel Pitoiset <[email protected]> Date: Tue Dec 28 11:01:38 2021 +0100 radv: fix copying mutable descriptors to sampler descriptors This fixes a heap-buffer-overflow detected by ASAN. Signed-off-by: Samuel Pitoiset <[email protected]> Reviewed-by: Bas Nieuwenhuizen <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/14330> --- src/amd/vulkan/radv_descriptor_set.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/amd/vulkan/radv_descriptor_set.c b/src/amd/vulkan/radv_descriptor_set.c index 1c8ee0d7a0d..e0f2d762b81 100644 --- a/src/amd/vulkan/radv_descriptor_set.c +++ b/src/amd/vulkan/radv_descriptor_set.c @@ -1283,8 +1283,10 @@ radv_update_descriptor_sets_impl(struct radv_device *device, struct radv_cmd_buf dst_ptr += dst_binding_layout->size / 4; if (src_binding_layout->type != VK_DESCRIPTOR_TYPE_SAMPLER && - src_binding_layout->type != VK_DESCRIPTOR_TYPE_ACCELERATION_STRUCTURE_KHR) { - /* Sampler descriptors don't have a buffer list. */ + dst_binding_layout->type != VK_DESCRIPTOR_TYPE_SAMPLER && + src_binding_layout->type != VK_DESCRIPTOR_TYPE_ACCELERATION_STRUCTURE_KHR && + dst_binding_layout->type != VK_DESCRIPTOR_TYPE_ACCELERATION_STRUCTURE_KHR) { + /* Sampler/acceleration structure descriptors don't have a buffer list. */ dst_buffer_list[j] = src_buffer_list[j]; } }
