Module: Mesa Branch: main Commit: 697e98c66e5ab10506b4a95c3e849c5d60d8e1a1 URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=697e98c66e5ab10506b4a95c3e849c5d60d8e1a1
Author: Juan A. Suarez Romero <[email protected]> Date: Thu Apr 21 16:26:39 2022 +0200 v3dv: duplicate key on hashtable insert The key is created on stack, so as soon as the function returns this key is lost, so the inserted key in the hashtable is invalid. Rather, insert a duplicated version on heap. This fixes a stack-buffer-overflow when running some Vulkan CTS tests. Signed-off-by: Juan A. Suarez Romero <[email protected]> Reviewed-by: Iago Toral Quiroga <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/16083> --- src/broadcom/vulkan/v3dv_meta_copy.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/broadcom/vulkan/v3dv_meta_copy.c b/src/broadcom/vulkan/v3dv_meta_copy.c index c474b507d52..a3a0eb47cde 100644 --- a/src/broadcom/vulkan/v3dv_meta_copy.c +++ b/src/broadcom/vulkan/v3dv_meta_copy.c @@ -1885,7 +1885,7 @@ get_copy_texel_buffer_pipeline( mtx_lock(&device->meta.mtx); struct hash_entry *entry = _mesa_hash_table_search(device->meta.texel_buffer_copy.cache[image_type], - &key); + key); if (entry) { mtx_unlock(&device->meta.mtx); *pipeline = entry->data; @@ -1914,8 +1914,10 @@ get_copy_texel_buffer_pipeline( if (!ok) goto fail; + uint8_t *dupkey = malloc(V3DV_META_TEXEL_BUFFER_COPY_CACHE_KEY_SIZE); + memcpy(dupkey, key, V3DV_META_TEXEL_BUFFER_COPY_CACHE_KEY_SIZE); _mesa_hash_table_insert(device->meta.texel_buffer_copy.cache[image_type], - &key, *pipeline); + dupkey, *pipeline); mtx_unlock(&device->meta.mtx); return true;
