diff options
author | Ilia Mirkin <imirkin@alum.mit.edu> | 2016-03-06 12:19:04 -0500 |
---|---|---|
committer | Dylan Baker <baker.dylan.c@gmail.com> | 2016-03-28 16:11:18 -0700 |
commit | 0ab3ce95e0303cdf7136bf7341e430c58223f561 (patch) | |
tree | 4e80faf6153901b47c3eeda4cfa58931ba25bf3b | |
parent | 33e5bc073e0929ed4b8b3a1923b4e5c70e2dd467 (diff) |
glsl: avoid stack smashing when there are too many attributes
This fixes a crash in
dEQP-GLES3.functional.transform_feedback.array_element.separate.points.lowp_mat3x2
and likely others. The vertex shader has > 16 input variables (without
explicit locations), which causes us to index outside of the to_assign
array.
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Reviewed-by: Timothy Arceri <timothy.arceri@collabora.com>
Cc: "11.1 11.2" <mesa-stable@lists.freedesktop.org>
(cherry picked from commit f6827e20d12ab062440bc809b8f2338b68edac45)
-rw-r--r-- | src/compiler/glsl/linker.cpp | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/compiler/glsl/linker.cpp b/src/compiler/glsl/linker.cpp index 3039232162..4cec107702 100644 --- a/src/compiler/glsl/linker.cpp +++ b/src/compiler/glsl/linker.cpp @@ -2625,6 +2625,13 @@ assign_attribute_or_color_locations(gl_shader_program *prog, continue; } + if (num_attr >= ARRAY_SIZE(to_assign)) { + linker_error(prog, "too many %s (max %u)", + target_index == MESA_SHADER_VERTEX ? + "vertex shader inputs" : "fragment shader outputs", + (unsigned)ARRAY_SIZE(to_assign)); + return false; + } to_assign[num_attr].slots = slots; to_assign[num_attr].var = var; num_attr++; |