Skip to content
Snippets Groups Projects
Commit ef8b0f09 authored by Axel Davy's avatar Axel Davy Committed by Dylan Baker
Browse files

frontend/nine: Fix buffer tracking out of bounds


Fixes a crash in a ffxi trace, which draws out of bounds.
This was previously resulting in trying to fill a buffer
resource not big enough.

cc: mesa-stable
Fixes: 380c2bf8 ("st/nine: Optimize dynamic systemmem buffers")

Signed-off-by: default avatarAxel Davy <davyaxel0@gmail.com>
Acked-by: default avatarDavid Heidelberg <david.heidelberg@collabora.com>
Part-of: <mesa/mesa!18021>
(cherry picked from commit e5124e83)
parent d16669e2
No related branches found
No related tags found
No related merge requests found
......@@ -940,7 +940,7 @@
"description": "frontend/nine: Fix buffer tracking out of bounds",
"nominated": true,
"nomination_type": 1,
"resolution": 0,
"resolution": 1,
"main_sha": null,
"because_sha": "380c2bf8876496183af50fa5bc59145f311962e0"
},
......@@ -272,6 +272,7 @@ NineBuffer9_Lock( struct NineBuffer9 *This,
if (!(This->base.usage & D3DUSAGE_DYNAMIC) && This->base.pool == D3DPOOL_DEFAULT)
SizeToLock = This->size - OffsetToLock;
SizeToLock = MIN2(SizeToLock, This->size - OffsetToLock); /* Do not read or track out of the buffer */
u_box_1d(OffsetToLock, SizeToLock, &box);
if (This->base.pool != D3DPOOL_DEFAULT) {
......
......@@ -2983,7 +2983,9 @@ NineTrackSystemmemDynamic( struct NineBuffer9 *This, unsigned start, unsigned wi
{
struct pipe_box box;
u_box_1d(start, width, &box);
if (start >= This->size)
return; /* outside bounds, nothing to do */
u_box_1d(start, MIN2(width, This->size-start), &box);
u_box_union_1d(&This->managed.required_valid_region,
&This->managed.required_valid_region,
&box);
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment