Module: Mesa Branch: master Commit: f6827e20d12ab062440bc809b8f2338b68edac45 URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=f6827e20d12ab062440bc809b8f2338b68edac45
Author: Ilia Mirkin <[email protected]> Date: Sun Mar 6 12:19:04 2016 -0500 glsl: avoid stack smashing when there are too many attributes This fixes a crash in dEQP-GLES3.functional.transform_feedback.array_element.separate.points.lowp_mat3x2 and likely others. The vertex shader has > 16 input variables (without explicit locations), which causes us to index outside of the to_assign array. Signed-off-by: Ilia Mirkin <[email protected]> Reviewed-by: Timothy Arceri <[email protected]> Cc: "11.1 11.2" <[email protected]> --- src/compiler/glsl/linker.cpp | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/compiler/glsl/linker.cpp b/src/compiler/glsl/linker.cpp index 3039232..4cec107 100644 --- a/src/compiler/glsl/linker.cpp +++ b/src/compiler/glsl/linker.cpp @@ -2625,6 +2625,13 @@ assign_attribute_or_color_locations(gl_shader_program *prog, continue; } + if (num_attr >= ARRAY_SIZE(to_assign)) { + linker_error(prog, "too many %s (max %u)", + target_index == MESA_SHADER_VERTEX ? + "vertex shader inputs" : "fragment shader outputs", + (unsigned)ARRAY_SIZE(to_assign)); + return false; + } to_assign[num_attr].slots = slots; to_assign[num_attr].var = var; num_attr++; _______________________________________________ mesa-commit mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/mesa-commit
