From: Mark Janes <mark.a.janes@intel.com>
Date: Wed, 10 Feb 2016 21:41:27 +0000 (-0800)
Subject: nir/spirv: fix build_mat_subdet stack smasher
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=8179834030c85722824a2a4863e4d5c2d75f07eb;p=mesa.git

nir/spirv: fix build_mat_subdet stack smasher

The sub-determinate implementation pattern fixed by
6a7e2904e0a2a6f8efbf739a1b3cad7e1e4ab42d has a second instance in the
same file.

With the previous algorithm, when row and j are both 3, the index
overruns the array.  This only impacts the stack on 32 bit builds.

Reviewed-by: Jason Ekstrand <jason.ekstrand@intel.com>
---

diff --git a/src/compiler/nir/spirv/vtn_glsl450.c b/src/compiler/nir/spirv/vtn_glsl450.c
index 4fceffa37a6..5fb73df0566 100644
--- a/src/compiler/nir/spirv/vtn_glsl450.c
+++ b/src/compiler/nir/spirv/vtn_glsl450.c
@@ -121,8 +121,11 @@ build_mat_subdet(struct nir_builder *b, struct vtn_ssa_value *src,
    } else {
       /* Swizzle to get all but the specified row */
       unsigned swiz[3];
-      for (unsigned j = 0; j < 4; j++)
-         swiz[j - (j > row)] = j;
+      for (unsigned j = 0, k = 0; j < 3; j++, k++) {
+         if (k == row)
+            k++; /* skip column */
+         swiz[j] = k;
+      }
 
       /* Grab all but the specified column */
       nir_ssa_def *subcol[3];