nv50: assert before trying to out-of-bounds access constbuf

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Reviewed-by: Ilia Mirkin <imirkin@alum.mit.edu>

diff --git a/src/gallium/drivers/nouveau/nv50/nv50_context.c b/src/gallium/drivers/nouveau/nv50/nv50_context.c
index bd00b5014468db77eb339aca5937894b1305b752..9ea425e4c9be32df904106d0a618b6721c327d1d 100644 (file)
--- a/src/gallium/drivers/nouveau/nv50/nv50_context.c
+++ b/src/gallium/drivers/nouveau/nv50/nv50_context.c
@@ -180,6 +180,7 @@ nv50_invalidate_resource_storage(struct nouveau_context *ctx,
 
    if (res->bind & PIPE_BIND_CONSTANT_BUFFER) {
       for (s = 0; s < 3; ++s) {
+      assert(nv50->num_vtxbufs <= NV50_MAX_PIPE_CONSTBUFS);
       for (i = 0; i < nv50->num_vtxbufs; ++i) {
          if (!nv50->constbuf[s][i].user &&
              nv50->constbuf[s][i].u.buf == res) {

diff --git a/src/gallium/drivers/nouveau/nv50/nv50_shader_state.c b/src/gallium/drivers/nouveau/nv50/nv50_shader_state.c
index 9144fc48d95a4199ca1381553106b929cd67536c..c44d208670d8ecdd9c3197db424336aca7599693 100644 (file)
--- a/src/gallium/drivers/nouveau/nv50/nv50_shader_state.c
+++ b/src/gallium/drivers/nouveau/nv50/nv50_shader_state.c
@@ -47,6 +47,8 @@ nv50_constbufs_validate(struct nv50_context *nv50)
 
       while (nv50->constbuf_dirty[s]) {
          const int i = ffs(nv50->constbuf_dirty[s]) - 1;
+
+         assert(i < NV50_MAX_PIPE_CONSTBUFS);
          nv50->constbuf_dirty[s] &= ~(1 << i);
 
          if (nv50->constbuf[s][i].user) {

diff --git a/src/gallium/drivers/nouveau/nv50/nv50_state.c b/src/gallium/drivers/nouveau/nv50/nv50_state.c
index 87dd07f9c010df58cf74b81d9b48347b4ac60e05..6b5a28893d46a6556c28bd2dd48025bab48281ad 100644 (file)
--- a/src/gallium/drivers/nouveau/nv50/nv50_state.c
+++ b/src/gallium/drivers/nouveau/nv50/nv50_state.c
@@ -786,6 +786,7 @@ nv50_set_constant_buffer(struct pipe_context *pipe, uint shader, uint index,
    if (shader == PIPE_SHADER_COMPUTE)
       return;
 
+   assert(i < NV50_MAX_PIPE_CONSTBUFS);
    if (nv50->constbuf[s][i].user)
       nv50->constbuf[s][i].u.buf = NULL;
    else