diff options
| author | Marc-André Lureau <marcandre.lureau@redhat.com> | 2016-01-20 14:18:15 +0100 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2016-02-10 12:39:47 +1000 |
| commit | ec24bd2211282a03ca919e9d1eccac0cff4a2383 (patch) | |
| tree | 911c0ce7598a9d81750c9daf52c3f51992e3a658 | |
| parent | 78f8994a63b4bfa68eeb5f7e9b9c6ec920ffc2e1 (diff) | |
decode: fix set_scissor_state bounds
Do not accept negative values for num & start.
Fix found thanks to american fuzzy lop.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
| -rw-r--r-- | src/vrend_decode.c | 2 | ||||
| -rw-r--r-- | src/vrend_renderer.c | 4 | ||||
| -rw-r--r-- | src/vrend_renderer.h | 4 |
3 files changed, 5 insertions, 5 deletions
diff --git a/src/vrend_decode.c b/src/vrend_decode.c index 7bcd50a..0e54a7a 100644 --- a/src/vrend_decode.c +++ b/src/vrend_decode.c @@ -762,7 +762,7 @@ static int vrend_decode_set_scissor_state(struct vrend_decode_ctx *ctx, int leng { struct pipe_scissor_state ss[PIPE_MAX_VIEWPORTS]; uint32_t temp; - int num_scissor, start_slot; + uint32_t num_scissor, start_slot; int s; if (length < 1) return EINVAL; diff --git a/src/vrend_renderer.c b/src/vrend_renderer.c index 12a9f7c..d61d9aa 100644 --- a/src/vrend_renderer.c +++ b/src/vrend_renderer.c @@ -4972,8 +4972,8 @@ void vrend_set_blend_color(struct vrend_context *ctx, } void vrend_set_scissor_state(struct vrend_context *ctx, - int start_slot, - int num_scissor, + uint32_t start_slot, + uint32_t num_scissor, struct pipe_scissor_state *ss) { int i, idx; diff --git a/src/vrend_renderer.h b/src/vrend_renderer.h index 78d00bd..4910fec 100644 --- a/src/vrend_renderer.h +++ b/src/vrend_renderer.h @@ -255,8 +255,8 @@ void vrend_renderer_blit(struct vrend_context *ctx, void vrend_set_stencil_ref(struct vrend_context *ctx, struct pipe_stencil_ref *ref); void vrend_set_blend_color(struct vrend_context *ctx, struct pipe_blend_color *color); void vrend_set_scissor_state(struct vrend_context *ctx, - int start_slot, - int num_scissor, + uint32_t start_slot, + uint32_t num_scissor, struct pipe_scissor_state *ss); void vrend_set_polygon_stipple(struct vrend_context *ctx, struct pipe_poly_stipple *ps); |