Module: Mesa
Branch: main
Commit: e0ed2b29f4cab496877a3d632c470d83df4b66d0
URL:    
http://cgit.freedesktop.org/mesa/mesa/commit/?id=e0ed2b29f4cab496877a3d632c470d83df4b66d0

Author: Patrick Lerda <[email protected]>
Date:   Sat Mar 25 21:52:27 2023 +0100

r600: fix typo that could lead to a possible crash

For instance, with "piglit/bin/arb_shader_image_load_store-host-mem-barrier 
--quick -auto -fbo":
==18549==ERROR: AddressSanitizer: heap-buffer-overflow on address 
0x61200000a059 at pc 0x7f65d8937b80 bp 0x7fff6ed19a00 sp 0x7fff6ed199f8
READ of size 1 at 0x61200000a059 thread T0
    #0 0x7f65d8937b7f in evergreen_set_shader_images 
../src/gallium/drivers/r600/evergreen_state.c:4277
    #1 0x7f65d6b471b8 in st_bind_images 
../src/mesa/state_tracker/st_atom_image.c:172
    #2 0x7f65d6b76b26 in st_validate_state 
../src/mesa/state_tracker/st_util.h:129
    #3 0x7f65d6b76b26 in prepare_draw ../src/mesa/state_tracker/st_draw.c:88
    #4 0x7f65d6b77c8a in st_draw_gallium ../src/mesa/state_tracker/st_draw.c:141
    #5 0x7f65d72698a2 in _mesa_draw_arrays ../src/mesa/main/draw.c:1202

Fixes: a6b379284365 ("r600: add core pieces of image support.")
Signed-off-by: Patrick Lerda <[email protected]>
Reviewed-by: Gert Wollny <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/22273>

---

 src/gallium/drivers/r600/evergreen_state.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/gallium/drivers/r600/evergreen_state.c 
b/src/gallium/drivers/r600/evergreen_state.c
index 7029cd32c12..b8a2ae768d3 100644
--- a/src/gallium/drivers/r600/evergreen_state.c
+++ b/src/gallium/drivers/r600/evergreen_state.c
@@ -4274,7 +4274,7 @@ static void evergreen_set_shader_images(struct 
pipe_context *ctx,
 
                bool is_buffer = image->target == PIPE_BUFFER;
                struct r600_texture *rtex = (struct r600_texture *)image;
-               if (!is_buffer & rtex->db_compatible)
+               if (!is_buffer && rtex->db_compatible)
                        istate->compressed_depthtex_mask |= 1 << i;
                else
                        istate->compressed_depthtex_mask &= ~(1 << i);

Reply via email to