i965: miptree: prevent potential NULL pointer access
authorLionel Landwerlin <lionel.g.landwerlin@intel.com>
Wed, 9 Nov 2016 16:33:51 +0000 (16:33 +0000)
committerLionel Landwerlin <lionel.g.landwerlin@intel.com>
Wed, 16 Nov 2016 08:56:08 +0000 (08:56 +0000)
If the mcs buffer allocation fails we might get a NULL pointer. This
was reported by Coverity and should only happen if we run out of
memory.

v2: return failure at the point of allocation (Chris)

CID: 1394290
Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
src/mesa/drivers/dri/i965/intel_mipmap_tree.c

index 6c81ffb5767bfb94b095c36278fe152328b17e74..28001b643bd3162de9fed6c029765552a1f603e9 100644 (file)
@@ -1486,6 +1486,8 @@ intel_miptree_init_mcs(struct brw_context *brw,
                        struct intel_mipmap_tree *mt,
                        int init_value)
 {
+   assert(mt->mcs_buf != NULL);
+
    /* From the Ivy Bridge PRM, Vol 2 Part 1 p326:
     *
     *     When MCS buffer is enabled and bound to MSRT, it is required that it
@@ -1604,10 +1606,12 @@ intel_miptree_alloc_mcs(struct brw_context *brw,
                                    mt->logical_width0,
                                    mt->logical_height0,
                                    MIPTREE_LAYOUT_ACCELERATED_UPLOAD);
+   if (!mt->mcs_buf)
+      return false;
 
    intel_miptree_init_mcs(brw, mt, 0xFF);
 
-   return mt->mcs_buf != NULL;
+   return true;
 }
 
 
@@ -1666,6 +1670,8 @@ intel_miptree_alloc_non_msrt_mcs(struct brw_context *brw,
                                               mcs_width,
                                               mcs_height,
                                               layout_flags);
+   if (!mt->mcs_buf)
+      return false;
 
    /* From Gen9 onwards single-sampled (non-msrt) auxiliary buffers are
     * used for lossless compression which requires similar initialisation
@@ -1686,7 +1692,7 @@ intel_miptree_alloc_non_msrt_mcs(struct brw_context *brw,
       mt->msaa_layout = INTEL_MSAA_LAYOUT_CMS;
    }
 
-   return mt->mcs_buf != NULL;
+   return true;
 }
 
 /**