From: Emil Velikov <[email protected]> Cap up-to the number of properties available while copying the data. Otherwise we might crash and/or leak data.
Cc: Dave Airlie <[email protected]> Cc: "13.0" <[email protected]> Signed-off-by: Emil Velikov <[email protected]> --- src/amd/vulkan/radv_device.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/src/amd/vulkan/radv_device.c b/src/amd/vulkan/radv_device.c index 390fde0..e6e5c37 100644 --- a/src/amd/vulkan/radv_device.c +++ b/src/amd/vulkan/radv_device.c @@ -669,17 +669,15 @@ VkResult radv_EnumerateInstanceExtensionProperties( uint32_t* pPropertyCount, VkExtensionProperties* pProperties) { - unsigned i; if (pProperties == NULL) { *pPropertyCount = ARRAY_SIZE(global_extensions); return VK_SUCCESS; } - for (i = 0; i < *pPropertyCount; i++) - memcpy(&pProperties[i], &global_extensions[i], sizeof(VkExtensionProperties)); + *pPropertyCount = MIN2(*pPropertyCount, ARRAY_SIZE(global_extensions)); + typed_memcpy(pProperties, global_extensions, *pPropertyCount); - *pPropertyCount = i; - if (i < ARRAY_SIZE(global_extensions)) + if (*pPropertyCount < ARRAY_SIZE(global_extensions)) return VK_INCOMPLETE; return VK_SUCCESS; @@ -691,19 +689,17 @@ VkResult radv_EnumerateDeviceExtensionProperties( uint32_t* pPropertyCount, VkExtensionProperties* pProperties) { - unsigned i; - if (pProperties == NULL) { *pPropertyCount = ARRAY_SIZE(device_extensions); return VK_SUCCESS; } - for (i = 0; i < *pPropertyCount; i++) - memcpy(&pProperties[i], &device_extensions[i], sizeof(VkExtensionProperties)); + *pPropertyCount = MIN2(*pPropertyCount, ARRAY_SIZE(device_extensions)); + typed_memcpy(pProperties, device_extensions, *pPropertyCount); - *pPropertyCount = i; - if (i < ARRAY_SIZE(device_extensions)) + if (*pPropertyCount < ARRAY_SIZE(device_extensions)) return VK_INCOMPLETE; + return VK_SUCCESS; } -- 2.10.2 _______________________________________________ mesa-dev mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/mesa-dev
