draw: Prevent out-of-bounds vertex buffer access.
[mesa.git] / src / gallium / auxiliary / util / u_draw.c
1 /**************************************************************************
2 *
3 * Copyright 2011 VMware, Inc.
4 * All Rights Reserved.
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a
7 * copy of this software and associated documentation files (the
8 * "Software"), to deal in the Software without restriction, including
9 * without limitation the rights to use, copy, modify, merge, publish,
10 * distribute, sub license, and/or sell copies of the Software, and to
11 * permit persons to whom the Software is furnished to do so, subject to
12 * the following conditions:
13 *
14 * The above copyright notice and this permission notice (including the
15 * next paragraph) shall be included in all copies or substantial portions
16 * of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
19 * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
20 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.
21 * IN NO EVENT SHALL VMWARE AND/OR ITS SUPPLIERS BE LIABLE FOR
22 * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
23 * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
24 * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
25 *
26 **************************************************************************/
27
28
29 #include "util/u_debug.h"
30 #include "util/u_math.h"
31 #include "util/u_format.h"
32 #include "util/u_draw.h"
33
34
35 /**
36 * Returns the largest legal index value for the current set of bound vertex
37 * buffers. Regardless of any other consideration, all vertex lookups need to
38 * be clamped to 0..max_index to prevent an out-of-bound access.
39 */
40 unsigned
41 util_draw_max_index(
42 const struct pipe_vertex_buffer *vertex_buffers,
43 unsigned nr_vertex_buffers,
44 const struct pipe_vertex_element *vertex_elements,
45 unsigned nr_vertex_elements,
46 const struct pipe_draw_info *info)
47 {
48 unsigned max_index;
49 unsigned i;
50
51 max_index = ~0;
52 for (i = 0; i < nr_vertex_elements; i++) {
53 const struct pipe_vertex_element *element =
54 &vertex_elements[i];
55 const struct pipe_vertex_buffer *buffer =
56 &vertex_buffers[element->vertex_buffer_index];
57 unsigned buffer_size;
58 const struct util_format_description *format_desc;
59 unsigned format_size;
60
61 assert(buffer->buffer->height0 == 1);
62 assert(buffer->buffer->depth0 == 1);
63 buffer_size = buffer->buffer->width0;
64
65 format_desc = util_format_description(element->src_format);
66 assert(format_desc->block.width == 1);
67 assert(format_desc->block.height == 1);
68 assert(format_desc->block.bits % 8 == 0);
69 format_size = format_desc->block.bits/8;
70
71 assert(buffer_size - buffer->buffer_offset <= buffer_size);
72 buffer_size -= buffer->buffer_offset;
73
74 assert(buffer_size - element->src_offset <= buffer_size);
75 buffer_size -= element->src_offset;
76
77 assert(buffer_size - format_size <= buffer_size);
78 buffer_size -= format_size;
79
80 if (buffer->stride != 0) {
81 unsigned buffer_max_index;
82
83 buffer_max_index = buffer_size / buffer->stride;
84
85 if (element->instance_divisor == 0) {
86 /* Per-vertex data */
87 max_index = MIN2(max_index, buffer_max_index);
88 }
89 else {
90 /* Per-instance data. Simply make sure the state tracker didn't
91 * request more instances than those that fit in the buffer */
92 assert((info->start_instance + info->instance_count)/element->instance_divisor
93 <= (buffer_max_index + 1));
94 }
95 }
96 }
97
98 return max_index;
99 }