From: Thomas Hindoe Paaboel Andersen <phomes@gmail.com>
Date: Wed, 13 Apr 2016 01:06:06 +0000 (+0200)
Subject: softpipe: avoid buffer overflow
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=6d6525a377250865cc6baa2c9cd5c6c0b6cd3f9c;p=mesa.git

softpipe: avoid buffer overflow

Signed-off-by: Dave Airlie <airlied@redhat.com>
---

diff --git a/src/gallium/drivers/softpipe/sp_buffer.c b/src/gallium/drivers/softpipe/sp_buffer.c
index 69717baa1a0..69a6bd18c3b 100644
--- a/src/gallium/drivers/softpipe/sp_buffer.c
+++ b/src/gallium/drivers/softpipe/sp_buffer.c
@@ -59,7 +59,7 @@ sp_tgsi_load(const struct tgsi_buffer *buffer,
    unsigned char *data_ptr;
    const struct util_format_description *format_desc = util_format_description(PIPE_FORMAT_R32_UINT);
 
-   if (params->unit > PIPE_MAX_SHADER_BUFFERS)
+   if (params->unit >= PIPE_MAX_SHADER_BUFFERS)
       goto fail_write_all_zero;
 
    bview = &sp_buf->sp_bview[params->unit];
@@ -117,7 +117,7 @@ sp_tgsi_store(const struct tgsi_buffer *buffer,
    int j, c;
    const struct util_format_description *format_desc = util_format_description(PIPE_FORMAT_R32_UINT);
 
-   if (params->unit > PIPE_MAX_SHADER_BUFFERS)
+   if (params->unit >= PIPE_MAX_SHADER_BUFFERS)
       return;
 
    bview = &sp_buf->sp_bview[params->unit];
@@ -293,7 +293,7 @@ sp_tgsi_op(const struct tgsi_buffer *buffer,
    int j, c;
    unsigned char *data_ptr;
 
-   if (params->unit > PIPE_MAX_SHADER_BUFFERS)
+   if (params->unit >= PIPE_MAX_SHADER_BUFFERS)
       return;
 
    bview = &sp_buf->sp_bview[params->unit];
@@ -345,7 +345,7 @@ sp_tgsi_get_dims(const struct tgsi_buffer *buffer,
    struct pipe_shader_buffer *bview;
    struct softpipe_resource *spr;
 
-   if (params->unit > PIPE_MAX_SHADER_BUFFERS)
+   if (params->unit >= PIPE_MAX_SHADER_BUFFERS)
       return;
 
    bview = &sp_buf->sp_bview[params->unit];
diff --git a/src/gallium/drivers/softpipe/sp_image.c b/src/gallium/drivers/softpipe/sp_image.c
index 3488fa83185..a7c73280a80 100644
--- a/src/gallium/drivers/softpipe/sp_image.c
+++ b/src/gallium/drivers/softpipe/sp_image.c
@@ -217,7 +217,7 @@ sp_tgsi_load(const struct tgsi_image *image,
    char *data_ptr;
    unsigned offset = 0;
 
-   if (params->unit > PIPE_MAX_SHADER_IMAGES)
+   if (params->unit >= PIPE_MAX_SHADER_IMAGES)
       goto fail_write_all_zero;
    iview = &sp_img->sp_iview[params->unit];
    spr = (struct softpipe_resource *)iview->resource;
@@ -320,7 +320,7 @@ sp_tgsi_store(const struct tgsi_image *image,
    unsigned offset = 0;
    unsigned pformat = params->format;
 
-   if (params->unit > PIPE_MAX_SHADER_IMAGES)
+   if (params->unit >= PIPE_MAX_SHADER_IMAGES)
       return;
    iview = &sp_img->sp_iview[params->unit];
    spr = (struct softpipe_resource *)iview->resource;
@@ -630,7 +630,7 @@ sp_tgsi_op(const struct tgsi_image *image,
    unsigned offset;
    char *data_ptr;
 
-   if (params->unit > PIPE_MAX_SHADER_IMAGES)
+   if (params->unit >= PIPE_MAX_SHADER_IMAGES)
       return;
    iview = &sp_img->sp_iview[params->unit];
    spr = (struct softpipe_resource *)iview->resource;
@@ -704,7 +704,7 @@ sp_tgsi_get_dims(const struct tgsi_image *image,
    struct softpipe_resource *spr;
    int level;
 
-   if (params->unit > PIPE_MAX_SHADER_IMAGES)
+   if (params->unit >= PIPE_MAX_SHADER_IMAGES)
       return;
    iview = &sp_img->sp_iview[params->unit];
    spr = (struct softpipe_resource *)iview->resource;