draw: Allocate extra padding for extra shader outputs.

This prevents read buffer overflows in dup_vertex(), when draw stages
allocate extra shader outputs after the vertex buffers are allocated.

The original issue can be exercised with upcoming
piglit/tests/general/vertex-fallbacks.c test.

Reviewed-by: Roland Scheidegger <sroland@vmware.com>
Cc: 21.0 21.1 <mesa-stable@lists.freedesktop.org>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/10836>
This commit is contained in:
Jose Fonseca
2021-05-14 16:25:32 +01:00
committed by Marge Bot
parent 0df249f542
commit 250605c57d
7 changed files with 49 additions and 12 deletions

View File

@@ -76,8 +76,8 @@ boolean draw_alloc_temp_verts( struct draw_stage *stage, unsigned nr )
if (nr != 0)
{
unsigned i;
ubyte *store = (ubyte *) MALLOC( MAX_VERTEX_SIZE * nr );
ubyte *store = (ubyte *) MALLOC( MAX_VERTEX_SIZE * nr +
DRAW_EXTRA_VERTICES_PADDING );
if (!store)
return FALSE;