Module: Mesa Branch: main Commit: 953dd9605fb674d04d78d8f3626e7627a85de23d URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=953dd9605fb674d04d78d8f3626e7627a85de23d
Author: Pavel Ondračka <[email protected]> Date: Fri Jul 14 12:16:28 2023 +0200 r300: check for index overflow when translating from TGSI Reviewed-by: Filip Gawin <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/24154> --- src/gallium/drivers/r300/r300_tgsi_to_rc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/gallium/drivers/r300/r300_tgsi_to_rc.c b/src/gallium/drivers/r300/r300_tgsi_to_rc.c index 137bfaf1e0c..82842c5fd67 100644 --- a/src/gallium/drivers/r300/r300_tgsi_to_rc.c +++ b/src/gallium/drivers/r300/r300_tgsi_to_rc.c @@ -144,9 +144,15 @@ static void transform_srcreg( struct tgsi_full_src_register * src) { dst->File = translate_register_file(src->Register.File); - dst->Index = translate_register_index(ttr, src->Register.File, src->Register.Index); + int index = translate_register_index(ttr, src->Register.File, src->Register.Index); /* Negative offsets to relative addressing should have been lowered in NIR */ - assert(dst->Index >= 0); + assert(index >= 0); + /* Also check for overflow */ + if (index >= RC_REGISTER_MAX_INDEX) { + ttr->error = true; + fprintf(stderr, "r300: Register index too high.\n"); + } + dst->Index = index; dst->RelAddr = src->Register.Indirect; dst->Swizzle = tgsi_util_get_full_src_register_swizzle(src, 0); dst->Swizzle |= tgsi_util_get_full_src_register_swizzle(src, 1) << 3;
