From fd92346c53ed32709c7b56ce58fb9c9bf43ce9a8 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Jos=C3=A9=20Fonseca?= Date: Thu, 3 Apr 2014 15:56:46 +0100 Subject: [PATCH] mesa/st: Fix pipe_framebuffer_state::height for PIPE_TEXTURE_1D_ARRAY. This prevents buffer overflow w/ llvmpipe when running piglit bin/gl-3.2-layered-rendering-clear-color-all-types 1d_array single_level -fbo -auto v2: Compute the framebuffer size as the minimum size, as pointed out by Brian; compacted code; ran piglit quick test list (with no regressions.) Reviewed-by: Brian Paul Reviewed-by: Roland Scheidegger --- src/mesa/state_tracker/st_atom_framebuffer.c | 35 ++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) diff --git a/src/mesa/state_tracker/st_atom_framebuffer.c b/src/mesa/state_tracker/st_atom_framebuffer.c index 4c4f839d1d0..a17417c3590 100644 --- a/src/mesa/state_tracker/st_atom_framebuffer.c +++ b/src/mesa/state_tracker/st_atom_framebuffer.c @@ -31,6 +31,8 @@ * Brian Paul */ +#include + #include "st_context.h" #include "st_atom.h" #include "st_cb_bitmap.h" @@ -43,6 +45,26 @@ #include "util/u_format.h" +/** + * Update framebuffer size. + * + * We need to derive pipe_framebuffer size from the bound pipe_surfaces here + * instead of copying gl_framebuffer size because for certain target types + * (like PIPE_TEXTURE_1D_ARRAY) gl_framebuffer::Height has the number of layers + * instead of 1. + */ +static void +update_framebuffer_size(struct pipe_framebuffer_state *framebuffer, + struct pipe_surface *surface) +{ + assert(surface); + assert(surface->width < UINT_MAX); + assert(surface->height < UINT_MAX); + framebuffer->width = MIN2(framebuffer->width, surface->width); + framebuffer->height = MIN2(framebuffer->height, surface->height); +} + + /** * Update framebuffer state (color, depth, stencil, etc. buffers) */ @@ -57,8 +79,8 @@ update_framebuffer_state( struct st_context *st ) st_flush_bitmap_cache(st); st->state.fb_orientation = st_fb_orientation(fb); - framebuffer->width = fb->Width; - framebuffer->height = fb->Height; + framebuffer->width = UINT_MAX; + framebuffer->height = UINT_MAX; /*printf("------ fb size %d x %d\n", fb->Width, fb->Height);*/ @@ -81,6 +103,7 @@ update_framebuffer_state( struct st_context *st ) if (strb->surface) { pipe_surface_reference(&framebuffer->cbufs[i], strb->surface); + update_framebuffer_size(framebuffer, strb->surface); } strb->defined = GL_TRUE; /* we'll be drawing something */ } @@ -100,12 +123,14 @@ update_framebuffer_state( struct st_context *st ) st_update_renderbuffer_surface(st, strb); } pipe_surface_reference(&framebuffer->zsbuf, strb->surface); + update_framebuffer_size(framebuffer, strb->surface); } else { strb = st_renderbuffer(fb->Attachment[BUFFER_STENCIL].Renderbuffer); if (strb) { assert(strb->surface); pipe_surface_reference(&framebuffer->zsbuf, strb->surface); + update_framebuffer_size(framebuffer, strb->surface); } else pipe_surface_reference(&framebuffer->zsbuf, NULL); @@ -122,6 +147,12 @@ update_framebuffer_state( struct st_context *st ) } #endif + /* _mesa_test_framebuffer_completeness refuses framebuffers with no + * attachments, so this should never happen. + */ + assert(framebuffer->width != UINT_MAX); + assert(framebuffer->height != UINT_MAX); + cso_set_framebuffer(st->cso_context, framebuffer); } -- 2.30.2