llvmpipe: fix overflow bug in total texture size computation

[mesa.git] / src / gallium / drivers / llvmpipe / lp_texture.c

diff --git a/src/gallium/drivers/llvmpipe/lp_texture.c b/src/gallium/drivers/llvmpipe/lp_texture.c
index fa4ce5bf2ac20816a187eb8b210219512e5194c6..841df004d14bad0842226fc715afb8866348af03 100644 (file)
--- a/src/gallium/drivers/llvmpipe/lp_texture.c
+++ b/src/gallium/drivers/llvmpipe/lp_texture.c
@@ -105,13 +105,15 @@ alloc_layout_array(unsigned num_slices, unsigned width, unsigned height)
  */
 static boolean
 llvmpipe_texture_layout(struct llvmpipe_screen *screen,
-                        struct llvmpipe_resource *lpr)
+                        struct llvmpipe_resource *lpr,
+                        boolean allocate)
 {
    struct pipe_resource *pt = &lpr->base;
    unsigned level;
    unsigned width = pt->width0;
    unsigned height = pt->height0;
    unsigned depth = pt->depth0;
+   uint64_t total_size = 0;
 
    assert(LP_MAX_TEXTURE_2D_LEVELS <= LP_MAX_TEXTURE_LEVELS);
    assert(LP_MAX_TEXTURE_3D_LEVELS <= LP_MAX_TEXTURE_LEVELS);
@@ -138,6 +140,12 @@ llvmpipe_texture_layout(struct llvmpipe_screen *screen,
 
          lpr->row_stride[level] = align(nblocksx * block_size, 16);
 
+         /* if row_stride * height > LP_MAX_TEXTURE_SIZE */
+         if (lpr->row_stride[level] > LP_MAX_TEXTURE_SIZE / nblocksy) {
+            /* image too large */
+            goto fail;
+         }
+
          lpr->img_stride[level] = lpr->row_stride[level] * nblocksy;
       }
 
@@ -162,7 +170,25 @@ llvmpipe_texture_layout(struct llvmpipe_screen *screen,
 
          lpr->num_slices_faces[level] = num_slices;
 
-         lpr->layout[level] = alloc_layout_array(num_slices, width, height);
+         if (allocate) {
+            lpr->layout[level] = alloc_layout_array(num_slices, width, height);
+            if (!lpr->layout[level]) {
+               goto fail;
+            }
+         }
+      }
+
+      /* if img_stride * num_slices_faces > LP_MAX_TEXTURE_SIZE */
+      if (lpr->img_stride[level] >
+          LP_MAX_TEXTURE_SIZE / lpr->num_slices_faces[level]) {
+         /* volume too large */
+         goto fail;
+      }
+
+      total_size += (uint64_t) lpr->num_slices_faces[level]
+                  * (uint64_t) lpr->img_stride[level];
+      if (total_size > LP_MAX_TEXTURE_SIZE) {
+         goto fail;
       }
 
       /* Compute size of next mipmap level */
@@ -172,9 +198,30 @@ llvmpipe_texture_layout(struct llvmpipe_screen *screen,
    }
 
    return TRUE;
+
+fail:
+   for (level = 0; level <= pt->last_level; level++) {
+      FREE(lpr->layout[level]);
+   }
+
+   return FALSE;
 }
 
 
+/**
+ * Check the size of the texture specified by 'res'.
+ * \return TRUE if OK, FALSE if too large.
+ */
+static boolean
+llvmpipe_can_create_resource(struct pipe_screen *screen,
+                             const struct pipe_resource *res)
+{
+   struct llvmpipe_resource lpr;
+   memset(&lpr, 0, sizeof(lpr));
+   lpr.base = *res;
+   return llvmpipe_texture_layout(llvmpipe_screen(screen), &lpr, FALSE);
+}
+
 
 static boolean
 llvmpipe_displaytarget_layout(struct llvmpipe_screen *screen,
@@ -196,7 +243,9 @@ llvmpipe_displaytarget_layout(struct llvmpipe_screen *screen,
    lpr->img_stride[0] = 0;
 
    lpr->layout[0] = alloc_layout_array(1, width, height);
-   //lpr->layout[0][0] = LP_TEX_LAYOUT_LINEAR;
+   if (!lpr->layout[0]) {
+      return FALSE;
+   }
 
    lpr->dt = winsys->displaytarget_create(winsys,
                                           lpr->base.bind,
@@ -205,7 +254,20 @@ llvmpipe_displaytarget_layout(struct llvmpipe_screen *screen,
                                           16,
                                           &lpr->row_stride[0] );
 
-   return lpr->dt != NULL;
+   if (lpr->dt == NULL)
+      return FALSE;
+
+   {
+      void *map = winsys->displaytarget_map(winsys, lpr->dt,
+                                            PIPE_TRANSFER_WRITE);
+
+      if (map)
+         memset(map, 0, height * lpr->row_stride[0]);
+
+      winsys->displaytarget_unmap(winsys, lpr->dt);
+   }
+
+   return TRUE;
 }
 
 
@@ -233,7 +295,7 @@ llvmpipe_resource_create(struct pipe_screen *_screen,
       }
       else {
          /* texture map */
-         if (!llvmpipe_texture_layout(screen, lpr))
+         if (!llvmpipe_texture_layout(screen, lpr, TRUE))
             goto fail;
          assert(lpr->layout[0][0] == LP_TEX_LAYOUT_NONE);
       }
@@ -251,6 +313,7 @@ llvmpipe_resource_create(struct pipe_screen *_screen,
       lpr->data = align_malloc(bytes, 16);
       if (!lpr->data)
          goto fail;
+      memset(lpr->data, 0, bytes);
    }
 
    lpr->id = id_counter++;
@@ -437,13 +500,15 @@ llvmpipe_resource_from_handle(struct pipe_screen *screen,
                              struct winsys_handle *whandle)
 {
    struct sw_winsys *winsys = llvmpipe_screen(screen)->winsys;
-   struct llvmpipe_resource *lpr = CALLOC_STRUCT(llvmpipe_resource);
+   struct llvmpipe_resource *lpr;
    unsigned width, height, width_t, height_t;
 
    /* XXX Seems like from_handled depth textures doesn't work that well */
 
-   if (!lpr)
-      return NULL;
+   lpr = CALLOC_STRUCT(llvmpipe_resource);
+   if (!lpr) {
+      goto no_lpr;
+   }
 
    lpr->base = *template;
    pipe_reference_init(&lpr->base.reference, 1);
@@ -472,12 +537,15 @@ llvmpipe_resource_from_handle(struct pipe_screen *screen,
                                                template,
                                                whandle,
                                                &lpr->row_stride[0]);
-   if (!lpr->dt)
-      goto fail;
+   if (!lpr->dt) {
+      goto no_dt;
+   }
 
    lpr->layout[0] = alloc_layout_array(1, lpr->base.width0, lpr->base.height0);
+   if (!lpr->layout[0]) {
+      goto no_layout_0;
+   }
 
-   assert(lpr->layout[0]);
    assert(lpr->layout[0][0] == LP_TEX_LAYOUT_NONE);
 
    lpr->id = id_counter++;
@@ -488,8 +556,11 @@ llvmpipe_resource_from_handle(struct pipe_screen *screen,
 
    return &lpr->base;
 
- fail:
+no_layout_0:
+   winsys->displaytarget_destroy(winsys, lpr->dt);
+no_dt:
    FREE(lpr);
+no_lpr:
    return NULL;
 }
 
@@ -712,7 +783,7 @@ llvmpipe_is_resource_referenced( struct pipe_context *pipe,
 /**
  * Create buffer which wraps user-space data.
  */
-static struct pipe_resource *
+struct pipe_resource *
 llvmpipe_user_buffer_create(struct pipe_screen *screen,
                             void *ptr,
                             unsigned bytes,
@@ -938,11 +1009,16 @@ alloc_image_data(struct llvmpipe_resource *lpr, unsigned level,
       /* tiled data is stored in regular memory */
       uint buffer_size = tex_image_size(lpr, level, layout);
       lpr->tiled[level].data = align_malloc(buffer_size, alignment);
+      if (lpr->tiled[level].data) {
+         memset(lpr->tiled[level].data, 0, buffer_size);
+      }
    }
    else {
       assert(layout == LP_TEX_LAYOUT_LINEAR);
       if (lpr->dt) {
-         /* we get the linear memory from the winsys */
+         /* we get the linear memory from the winsys, and it has
+          * already been zeroed
+          */
          struct llvmpipe_screen *screen = llvmpipe_screen(lpr->base.screen);
          struct sw_winsys *winsys = screen->winsys;
 
@@ -954,6 +1030,9 @@ alloc_image_data(struct llvmpipe_resource *lpr, unsigned level,
          /* not a display target - allocate regular memory */
          uint buffer_size = tex_image_size(lpr, level, LP_TEX_LAYOUT_LINEAR);
          lpr->linear[level].data = align_malloc(buffer_size, alignment);
+         if (lpr->linear[level].data) {
+            memset(lpr->linear[level].data, 0, buffer_size);
+         }
       }
    }
 }
@@ -1388,8 +1467,7 @@ llvmpipe_init_screen_resource_funcs(struct pipe_screen *screen)
    screen->resource_destroy = llvmpipe_resource_destroy;
    screen->resource_from_handle = llvmpipe_resource_from_handle;
    screen->resource_get_handle = llvmpipe_resource_get_handle;
-   screen->user_buffer_create = llvmpipe_user_buffer_create;
-
+   screen->can_create_resource = llvmpipe_can_create_resource;
 }