llvmpipe: clamp scissors to be between 0 and max

We need to clamp to make sure invalid shader doesn't crash our
driver. The spec says to return 0-th index for everything that's
out of bounds.

Signed-off-by: Zack Rusin <zackr@vmware.com>
Reviewed-by: José Fonseca<jfonseca@vmware.com>
Reviewed-by: Brian Paul <brianp@vmware.com>

diff --git a/src/gallium/drivers/llvmpipe/lp_setup.h b/src/gallium/drivers/llvmpipe/lp_setup.h
index 1f55aa41c7f8674e098b642705c5a85981826d7c..712ed145d8e8d268e0eeebc52304e657ffdf240e 100644 (file)
--- a/src/gallium/drivers/llvmpipe/lp_setup.h
+++ b/src/gallium/drivers/llvmpipe/lp_setup.h
@@ -154,4 +154,10 @@ void
 lp_setup_end_query(struct lp_setup_context *setup,
                    struct llvmpipe_query *pq);
 
+static INLINE unsigned
+lp_clamp_scissor_idx(int idx)
+{
+   return (PIPE_MAX_VIEWPORTS > idx && idx >= 0) ? idx : 0;
+}
+
 #endif

diff --git a/src/gallium/drivers/llvmpipe/lp_setup_line.c b/src/gallium/drivers/llvmpipe/lp_setup_line.c
index c2a069fe0663d5d5d086056f4410d8346e9d8ab6..57a96d57ce7b524e5ee8e73204bcd773de91d036 100644 (file)
--- a/src/gallium/drivers/llvmpipe/lp_setup_line.c
+++ b/src/gallium/drivers/llvmpipe/lp_setup_line.c
@@ -318,7 +318,7 @@ try_setup_line( struct lp_setup_context *setup,
       nr_planes = 8;
       if (setup->viewport_index_slot > 0) {
          unsigned *udata = (unsigned*)v1[setup->viewport_index_slot];
-         scissor_index = *udata;
+         scissor_index = lp_clamp_scissor_idx(*udata);
       }
    }
    else {

diff --git a/src/gallium/drivers/llvmpipe/lp_setup_point.c b/src/gallium/drivers/llvmpipe/lp_setup_point.c
index 30ce7490de983531c6f5279a3f3bd349be5fcd6f..b8040ae56f6d627f95f5db348a0dbe7df2b04988 100644 (file)
--- a/src/gallium/drivers/llvmpipe/lp_setup_point.c
+++ b/src/gallium/drivers/llvmpipe/lp_setup_point.c
@@ -328,7 +328,7 @@ try_setup_point( struct lp_setup_context *setup,
 
    if (setup->viewport_index_slot > 0) {
       unsigned *udata = (unsigned*)v0[setup->viewport_index_slot];
-      scissor_index = *udata;
+      scissor_index = lp_clamp_scissor_idx(*udata);
    }
    /* Bounding rectangle (in pixels) */
    {

diff --git a/src/gallium/drivers/llvmpipe/lp_setup_tri.c b/src/gallium/drivers/llvmpipe/lp_setup_tri.c
index c1ba52e8ca66229eb28b9517b78c73411fef6de4..e0aaa196c9ac6dbc3543753bbe5b2520b955cf8c 100644 (file)
--- a/src/gallium/drivers/llvmpipe/lp_setup_tri.c
+++ b/src/gallium/drivers/llvmpipe/lp_setup_tri.c
@@ -258,7 +258,7 @@ do_triangle_ccw(struct lp_setup_context *setup,
       nr_planes = 7;
       if (setup->viewport_index_slot > 0) {
          unsigned *udata = (unsigned*)v0[setup->viewport_index_slot];
-         scissor_index = *udata;
+         scissor_index = lp_clamp_scissor_idx(*udata);
       }
    }
    else {

diff --git a/src/gallium/drivers/llvmpipe/lp_state_clip.c b/src/gallium/drivers/llvmpipe/lp_state_clip.c
index 0e027fa9128ae29c43b95134a7dff47d1941b2e4..2d4f27c78ab33017a90d6df6ee6a6361949ee52a 100644 (file)
--- a/src/gallium/drivers/llvmpipe/lp_state_clip.c
+++ b/src/gallium/drivers/llvmpipe/lp_state_clip.c
@@ -71,8 +71,12 @@ llvmpipe_set_scissor_states(struct pipe_context *pipe,
 
    draw_flush(llvmpipe->draw);
 
+   debug_assert(start_slot < PIPE_MAX_VIEWPORTS);
+   debug_assert((start_slot + num_scissors) <= PIPE_MAX_VIEWPORTS);
+
    memcpy(llvmpipe->scissors + start_slot, scissors,
           sizeof(struct pipe_scissor_state) * num_scissors);
+   
    llvmpipe->dirty |= LP_NEW_SCISSOR;
 }