Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Register
  • Sign in
  • mesa mesa
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 3,083
    • Issues 3,083
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 997
    • Merge requests 997
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Releases
  • Packages and registries
    • Packages and registries
    • Container Registry
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar

Due to an influx of spam, we have had to impose restrictions on new accounts. Please see this wiki page for instructions on how to get full permissions. Sorry for the inconvenience.

  • MesaMesa
  • mesamesa
  • Merge requests
  • !19683

lavapipe: Prevent integer overflow adding index buffer offset and start index.

  • Review changes

  • Download
  • Email patches
  • Plain diff
Merged Jose Fonseca requested to merge jrfonseca/mesa:llvmpipe-draw-ib-oob into main Nov 11, 2022
  • Overview 2
  • Commits 3
  • Pipelines 6
  • Changes 6

Direct3D and Vulkan's robustBufferAccess2 feature mandate that index buffer out-of-bounds reads should return a zero index (ie, vertex at index zero, not to be confused with a vertex with zero attributes, as the kind resulting in vertex buffer out-of-bounds read.)

lavapipe was adding index_offset and start index together without overflow checks, and if start index was sufficient large (as is the case with WHCK wgf11draw which sets start index to (UINT)-5) it would cause to wrap around causing fetches that should be out of bounds wrap around and fetch inside bounds.

This change fixes this by doing a clamped add. This ensures start index is set to UINT32_MAX on overflow, which is sufficient in practice to trigger draw index OOB code-paths, yield zero index to be returned.

This MR also fixes compiler warnings when shader cache disabled.

/cc @brianp, @sroland, @zmike

Assignee
Assign to
Reviewers
Request review from
Time tracking
Source branch: llvmpipe-draw-ib-oob