intel: Fix size of temporary etc1 buffer

Fixes valgrind errors in piglit test
oes_compressed_etc1_rgb8_texture-miptree: an invalid write in
_mesa_store_compressed_store_texsubimage() at line 4406 and invalid reads
in texcompress_etc_tmp.h:etc1_parse_block().

The calculation of the size of the temporary etc1 buffer allocated by
intel_miptree_map_etc1() was incorrect. Sometimes the allocated buffer was
too small, sometimes too large.  This patch corrects the size to that
expected by _mesa_store_compressed_store_texsubimage().

Note: This is candidate for the 9.0 branch.
Reviewed-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Chad Versace <chad.versace@linux.intel.com>

diff --git a/src/mesa/drivers/dri/intel/intel_mipmap_tree.c b/src/mesa/drivers/dri/intel/intel_mipmap_tree.c
index 556a82fc7ffd531bf22179cdc38dd1945972d7df..cd7299e2a3062e12ce46bfb5527900c2350fb192 100644 (file)
--- a/src/mesa/drivers/dri/intel/intel_mipmap_tree.c
+++ b/src/mesa/drivers/dri/intel/intel_mipmap_tree.c
@@ -1292,9 +1292,10 @@ intel_miptree_map_etc1(struct intel_context *intel,
    assert(map->x == 0);
    assert(map->y == 0);
 
-   /* Each ETC1 block contains 4x4 pixels in 8 bytes. */
-   map->stride = 2 * map->w;
-   map->buffer = map->ptr = malloc(map->stride * map->h);
+   map->stride = _mesa_format_row_stride(MESA_FORMAT_ETC1_RGB8, map->w);
+   map->buffer = malloc(_mesa_format_image_size(MESA_FORMAT_ETC1_RGB8,
+                                                map->w, map->h, 1));
+   map->ptr = map->buffer;
 }
 
 static void