radv: fix out-of-bounds access when copying descriptors BO list

We shouldn't increment the buffer list pointers twice.

This fixes some crashes with new CTS
dEQP-VK.binding_model.descriptor_copy.*.

Cc: 18.3 19.0 <mesa-stable@lists.freedesktop.org>
Signed-off-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
Reviewed-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>

diff --git a/src/amd/vulkan/radv_descriptor_set.c b/src/amd/vulkan/radv_descriptor_set.c
index e47ae6ad67a9311bfd7689dd820b01728c75c557..e6649305961275b6700412a5048e3e6c80b2d3f3 100644 (file)
--- a/src/amd/vulkan/radv_descriptor_set.c
+++ b/src/amd/vulkan/radv_descriptor_set.c
@@ -970,8 +970,6 @@ void radv_update_descriptor_sets(
                        src_ptr += src_binding_layout->size / 4;
                        dst_ptr += dst_binding_layout->size / 4;
                        dst_buffer_list[j] = src_buffer_list[j];
-                       ++src_buffer_list;
-                       ++dst_buffer_list;
                }
        }
 }