r600g: increase array size for shader inputs and outputs

and add assertions to prevent buffer overflow. This fixes corruption
of the r600_shader struct.

NOTE: This is a candidate for the stable branches.

diff --git a/src/gallium/drivers/r600/r600_shader.c b/src/gallium/drivers/r600/r600_shader.c
index 78266c07cea881da8a660e7a2dc22439debea830..4416ef0fde2ad09368ab8b7a52a81bf45e5a96cc 100644 (file)
--- a/src/gallium/drivers/r600/r600_shader.c
+++ b/src/gallium/drivers/r600/r600_shader.c
@@ -571,6 +571,7 @@ static int tgsi_declaration(struct r600_shader_ctx *ctx)
        switch (d->Declaration.File) {
        case TGSI_FILE_INPUT:
                i = ctx->shader->ninput;
+                assert(i < Elements(ctx->shader->input));
                ctx->shader->ninput += count;
                ctx->shader->input[i].name = d->Semantic.Name;
                ctx->shader->input[i].sid = d->Semantic.Index;
@@ -602,6 +603,7 @@ static int tgsi_declaration(struct r600_shader_ctx *ctx)
                break;
        case TGSI_FILE_OUTPUT:
                i = ctx->shader->noutput++;
+                assert(i < Elements(ctx->shader->output));
                ctx->shader->output[i].name = d->Semantic.Name;
                ctx->shader->output[i].sid = d->Semantic.Index;
                ctx->shader->output[i].gpr = ctx->file_offset[TGSI_FILE_OUTPUT] + d->Range.First;

diff --git a/src/gallium/drivers/r600/r600_shader.h b/src/gallium/drivers/r600/r600_shader.h
index 411667ae89eac58bb52bdbb3ca28fd0f9efeb9ff..d989ce436497e64311310b8ed9eaee3a495019fa 100644 (file)
--- a/src/gallium/drivers/r600/r600_shader.h
+++ b/src/gallium/drivers/r600/r600_shader.h
@@ -45,8 +45,8 @@ struct r600_shader {
        unsigned                ninput;
        unsigned                noutput;
        unsigned                nlds;
-       struct r600_shader_io   input[32];
-       struct r600_shader_io   output[32];
+       struct r600_shader_io   input[40];
+       struct r600_shader_io   output[40];
        boolean                 uses_kill;
        boolean                 fs_write_all;
        boolean                 two_side;