NeroReflex/mesa
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

translate: deal with size overflows by casting to ptrdiff_t

Browse source 
This was discovered as a result of the draw-elements-base-vertex-neg
piglit test, which passes very negative offsets in, followed up by large
indices. The nouveau code correctly adjusts the pointer, but the
translate code needs to do the proper inverse correction. Similarly fix
up the SSE code to do a 64-bit multiply to compute the proper offset.

Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Reviewed-by: Brian Paul <brianp@vmware.com>
This commit is contained in:
Ilia Mirkin 2014-01-21 19:45:18 -05:00 • committed by Maarten Lankhorst
parent 4dd445f1cf
commit 3de97ce920
2 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/gallium/auxiliary/translate/translate_generic.c
View file

@ -638,7 +638,7 @@ static ALWAYS_INLINE void PIPE_CDECL generic_run_one( struct translate_generic *
}
src = tg->attrib[attr].input_ptr +
tg->attrib[attr].input_stride * index;
(ptrdiff_t)tg->attrib[attr].input_stride * index;
copy_size = tg->attrib[attr].copy_size;
if(likely(copy_size >= 0))

8
src/gallium/auxiliary/translate/translate_sse.c
View file

@ -1121,7 +1121,9 @@ static boolean init_inputs( struct translate_sse *p,
x86_cmovcc(p->func, tmp_EAX, buf_max_index, cc_AE);
}
x86_imul(p->func, tmp_EAX, buf_stride);
x86_mov(p->func, p->tmp2_EDX, buf_stride);
x64_rexw(p->func);
x86_imul(p->func, tmp_EAX, p->tmp2_EDX);
x64_rexw(p->func);
x86_add(p->func, tmp_EAX, buf_base_ptr);
@ -1207,7 +1209,9 @@ static struct x86_reg get_buffer_ptr( struct translate_sse *p,
x86_cmp(p->func, ptr, buf_max_index);
x86_cmovcc(p->func, ptr, buf_max_index, cc_AE);
x86_imul(p->func, ptr, buf_stride);
x86_mov(p->func, p->tmp2_EDX, buf_stride);
x64_rexw(p->func);
x86_imul(p->func, ptr, p->tmp2_EDX);
x64_rexw(p->func);
x86_add(p->func, ptr, buf_base_ptr);
return ptr;