radeonsi: reject invalid vertex buffer indices at state creation

Reviewed-by: Nicolai Hähnle <nicolai.haehnle@amd.com>

diff --git a/src/gallium/drivers/radeonsi/si_descriptors.c b/src/gallium/drivers/radeonsi/si_descriptors.c
index 0a49c877b12297d12936ec28618c701c0ab6ab3c..56356210c2a0c9da4d22294b781072552714194a 100644 (file)
--- a/src/gallium/drivers/radeonsi/si_descriptors.c
+++ b/src/gallium/drivers/radeonsi/si_descriptors.c
@@ -970,11 +970,6 @@ bool si_upload_vertex_buffer_descriptors(struct si_context *sctx)
                unsigned offset;
                uint32_t *desc = &ptr[i*4];
 
-               if (ve->vertex_buffer_index >= ARRAY_SIZE(sctx->vertex_buffer)) {
-                       memset(desc, 0, 16);
-                       continue;
-               }
-
                vb = &sctx->vertex_buffer[ve->vertex_buffer_index];
                rbuffer = (struct r600_resource*)vb->buffer;
                if (!rbuffer) {

diff --git a/src/gallium/drivers/radeonsi/si_state.c b/src/gallium/drivers/radeonsi/si_state.c
index 4aa1cd7436d605d0422fc0168e973914aa9bca85..3022260f2ff2121564baeed810833ab44b7e3980 100644 (file)
--- a/src/gallium/drivers/radeonsi/si_state.c
+++ b/src/gallium/drivers/radeonsi/si_state.c
@@ -3335,6 +3335,12 @@ static void *si_create_vertex_elements(struct pipe_context *ctx,
                const struct util_format_channel_description *channel;
                unsigned data_format, num_format;
                int first_non_void;
+               unsigned vbo_index = elements[i].vertex_buffer_index;
+
+               if (vbo_index >= SI_NUM_VERTEX_BUFFERS) {
+                       FREE(v);
+                       return NULL;
+               }
 
                desc = util_format_description(elements[i].src_format);
                first_non_void = util_format_get_first_non_void_channel(elements[i].src_format);