Owain Ainsworth wrote:
> swizzle_copy() in src/mesa/main/texstore.c almost always accesses memory
> out of bounds since it does COPY_4UBV() while stepping through an array
> when there's less than 4 elements left, only the srcComponents == 4 case
> is safe. Discovered on OpenBSD with mplayer -vo gl2 since openbsd's
> malloc tries to put an unmapped page after large allocations, causing a
> segfault on access out of bounds, so this always crashed.
>
> the following diff has been shown to work, extra work may be needed to
> deal with the rest of the tmp[] array to make sure it's sane. Some
> discussion and advice from Michel Danzer (sorry for the lack of the
> accent).
>
> this diff will, however, cause some slowdown, due to the extra looping,
> i suppose you could fix it by special casing the function and doing:
>
> swizzle_copy()
> {
> switch (srcComponents) {
> case 1:
> swizzle_copy1();
> case 2:
> swizzle_copy2();
> case 3:
> swizzle_copy3();
> case 4:
> swizzle_copy4();
> }
> }
>
> with the obvious increase in object size that would cause, patch not
> included, but is obvious. No benchmark difference included since it
> won't run on my machines without the patch...
I'm about to check in a fix using some macro/template code to keep the
speed of the original while avoiding reading out of bounds. That's been
a known issue for a while.
-Brian
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Mesa3d-dev mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mesa3d-dev
