From 83fb63d31de51cd49a947f68393672e97b307f37 Mon Sep 17 00:00:00 2001 From: Li Qiang Date: Mon, 23 Jan 2017 02:44:03 -0500 Subject: [PATCH] gallium/tgsi: fix oob access in parse instruction When parsing texture instruction, it doesn't stop if the 'cur' is ',', the loop variable 'i' will also be increased and be used to index the 'inst.TexOffsets' array. This can lead an oob access issue. This patch avoid this. Reviewed-by: Dave Airlie Signed-off-by: Li Qiang --- src/gallium/auxiliary/tgsi/tgsi_text.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gallium/auxiliary/tgsi/tgsi_text.c b/src/gallium/auxiliary/tgsi/tgsi_text.c index 308e6b52627..4ed905036f1 100644 --- a/src/gallium/auxiliary/tgsi/tgsi_text.c +++ b/src/gallium/auxiliary/tgsi/tgsi_text.c @@ -1163,7 +1163,7 @@ parse_instruction( cur = ctx->cur; eat_opt_white( &cur ); - for (i = 0; inst.Instruction.Texture && *cur == ','; i++) { + for (i = 0; inst.Instruction.Texture && *cur == ',' && i < TGSI_FULL_MAX_TEX_OFFSETS; i++) { cur++; eat_opt_white( &cur ); ctx->cur = cur; -- 2.30.2