swizzle_copy() in src/mesa/main/texstore.c almost always accesses memory
out of bounds since it does COPY_4UBV() while stepping through an array
when there's less than 4 elements left, only the srcComponents == 4 case
is safe. Discovered on OpenBSD with mplayer -vo gl2 since openbsd's
malloc tries to put an unmapped page after large allocations, causing a
segfault on access out of bounds, so this always crashed.
the following diff has been shown to work, extra work may be needed to
deal with the rest of the tmp[] array to make sure it's sane. Some
discussion and advice from Michel Danzer (sorry for the lack of the
accent).
this diff will, however, cause some slowdown, due to the extra looping,
i suppose you could fix it by special casing the function and doing:
swizzle_copy()
{
switch (srcComponents) {
case 1:
swizzle_copy1();
case 2:
swizzle_copy2();
case 3:
swizzle_copy3();
case 4:
swizzle_copy4();
}
}
with the obvious increase in object size that would cause, patch not
included, but is obvious. No benchmark difference included since it
won't run on my machines without the patch...
Cheers,
-0-
--
The bigger the theory the better.
Index: macros.h
===================================================================
RCS file: /cvs/xenocara/dist/Mesa/src/mesa/main/macros.h,v
retrieving revision 1.1.1.2
diff -u -p -r1.1.1.2 macros.h
--- macros.h 3 Mar 2007 11:56:37 -0000 1.1.1.2
+++ macros.h 7 Aug 2008 15:26:48 -0000
@@ -173,6 +173,15 @@ do { \
} while (0)
#endif
+/* Copy an X-element unsigned byte vector */
+#define COPY_XUBV(x, tmp, src) \
+do { \
+ int i; \
+ for (i = 0; i < x; i++) \
+ tmp[i] = src[i]; \
+} while(0)
+
+
/**
* Copy a 4-element float vector (avoid using FPU registers)
* XXX Could use two 64-bit moves on 64-bit systems
Index: texstore.c
===================================================================
RCS file: /cvs/xenocara/dist/Mesa/src/mesa/main/texstore.c,v
retrieving revision 1.2
diff -u -p -r1.2 texstore.c
--- texstore.c 31 May 2008 16:36:48 -0000 1.2
+++ texstore.c 7 Aug 2008 15:27:17 -0000
@@ -670,7 +670,7 @@ swizzle_copy(GLubyte *dst, GLuint dstCom
switch (dstComponents) {
case 4:
for (i = 0; i < count; i++) {
- COPY_4UBV(tmp, src);
+ COPY_XUBV(srcComponents, tmp, src);
src += srcComponents;
dst[0] = tmp[map[0]];
dst[1] = tmp[map[1]];
@@ -681,7 +681,7 @@ swizzle_copy(GLubyte *dst, GLuint dstCom
break;
case 3:
for (i = 0; i < count; i++) {
- COPY_4UBV(tmp, src);
+ COPY_XUBV(srcComponents, tmp, src);
src += srcComponents;
dst[0] = tmp[map[0]];
dst[1] = tmp[map[1]];
@@ -691,7 +691,7 @@ swizzle_copy(GLubyte *dst, GLuint dstCom
break;
case 2:
for (i = 0; i < count; i++) {
- COPY_4UBV(tmp, src);
+ COPY_XUBV(srcComponents, tmp, src);
src += srcComponents;
dst[0] = tmp[map[0]];
dst[1] = tmp[map[1]];
@@ -699,9 +699,8 @@ swizzle_copy(GLubyte *dst, GLuint dstCom
}
break;
case 1:
- /* XXX investigate valgrind invalid read when running demos/texenv.c */
for (i = 0; i < count; i++) {
- COPY_4UBV(tmp, src);
+ COPY_XUBV(srcComponents, tmp, src);
src += srcComponents;
dst[0] = tmp[map[0]];
dst += 1;
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Mesa3d-dev mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mesa3d-dev
