gallivm/nir: don't access stream var outside bounds
authorDave Airlie <airlied@redhat.com>
Fri, 19 Jun 2020 06:18:22 +0000 (16:18 +1000)
committerDave Airlie <airlied@redhat.com>
Tue, 7 Jul 2020 20:06:05 +0000 (06:06 +1000)
Since we allocate only enough for streams we see, don't access
out of bounds when streams are given

Reviewed-by: Roland Scheidegger <sroland@vmware.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/5555>

src/gallium/auxiliary/gallivm/lp_bld_nir_soa.c

index a8b7d0dd86e2d5f5608c702136b3e393e8178d02..7da701f06d8244d1974f1ddea4e9ed75417d4b88 100644 (file)
@@ -1593,6 +1593,8 @@ static void emit_vertex(struct lp_build_nir_context *bld_base, uint32_t stream_i
    struct lp_build_nir_soa_context *bld = (struct lp_build_nir_soa_context *)bld_base;
    LLVMBuilderRef builder = bld->bld_base.base.gallivm->builder;
 
+   if (stream_id >= bld->gs_vertex_streams)
+      return;
    assert(bld->gs_iface->emit_vertex);
    LLVMValueRef total_emitted_vertices_vec =
       LLVMBuildLoad(builder, bld->total_emitted_vertices_vec_ptr[stream_id], "");
@@ -1617,6 +1619,8 @@ end_primitive_masked(struct lp_build_nir_context * bld_base,
    struct lp_build_nir_soa_context *bld = (struct lp_build_nir_soa_context *)bld_base;
    LLVMBuilderRef builder = bld->bld_base.base.gallivm->builder;
 
+   if (stream_id >= bld->gs_vertex_streams)
+      return;
    struct lp_build_context *uint_bld = &bld_base->uint_bld;
    LLVMValueRef emitted_vertices_vec =
       LLVMBuildLoad(builder, bld->emitted_vertices_vec_ptr[stream_id], "");