diff options
| author | Marc-André Lureau <marcandre.lureau@redhat.com> | 2016-01-19 14:37:50 +0100 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2016-02-10 12:01:38 +1000 |
| commit | ad4f0f1941677c6cd78bcd14348cd99ae7dd7527 (patch) | |
| tree | d78ef0e6084827c64206f7f3664dadcf1c91417d | |
| parent | f58e985a63d1ac579bb3bb48cc49ec0fdff7d3ed (diff) | |
renderer: reject large LOD values
Or we could sit for a very long time in some further loops.
Fix found thanks to american fuzzy lop.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
| -rw-r--r-- | src/vrend_renderer.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/vrend_renderer.c b/src/vrend_renderer.c index 5374f09..ab60729 100644 --- a/src/vrend_renderer.c +++ b/src/vrend_renderer.c @@ -3935,6 +3935,8 @@ static int check_resource_valid(struct vrend_renderer_resource_create_args *args /* buffer and rect textures can't have mipmaps */ if (args->target == PIPE_BUFFER || args->target == PIPE_TEXTURE_RECT) return -1; + if (args->last_level > (floor(log2(MAX2(args->width, args->width))) + 1)) + return -1; } if (args->flags != 0 && args->flags != VIRGL_RESOURCE_Y_0_TOP) return -1; |