diff options
| author | Gert Wollny <gert.wollny@collabora.com> | 2023-09-05 11:42:57 +0200 |
|---|---|---|
| committer | Marge Bot <emma+marge@anholt.net> | 2023-09-06 06:38:34 +0000 |
| commit | fa90b4e5cdc9fa9a7a3ae74f3e0bd35907c365d4 (patch) | |
| tree | 445414fe8b64dac80990d0f374ade8be180ffe34 | |
| parent | 14c2141ed138ff5a4afd9e8535d30509155ddeea (diff) | |
shader: Check number of shader inputs to avoid OOB write
Patch follows suggestion by Kevin King.
Closes: https://gitlab.freedesktop.org/virgl/virglrenderer/-/issues/455
Signed-off-by: Gert Wollny <gert.wollny@collabora.com>
Part-of: <https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/1216>
| -rw-r--r-- | src/vrend_shader.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/vrend_shader.c b/src/vrend_shader.c index 8960aa7..53a4785 100644 --- a/src/vrend_shader.c +++ b/src/vrend_shader.c @@ -1155,6 +1155,11 @@ iter_decls(struct tgsi_iterate_context *iter, } if (ctx->prog_type == TGSI_PROCESSOR_FRAGMENT) { + if (ctx->num_inputs >= ARRAY_SIZE(ctx->inputs)) { + virgl_error( "Number of inputs exceeded, max is %lu\n", ARRAY_SIZE(ctx->inputs)); + return false; + } + for (uint32_t j = 0; j < ctx->num_inputs; j++) { if (ctx->inputs[j].name == decl->Semantic.Name && ctx->inputs[j].sid == decl->Semantic.Index && |