OpenHarmony/third_party_mesa3d
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

iris: Avoid read of uninitialized value in blorp_clear_stencil_as_rgba()

Browse Source 
In clear_depth_stencil() stencil_surf is defined but not initiaized.
Then in the same function if stencil_mask is calculated and if != 0
stencil_surf is initialized.
But blorp_clear_stencil_as_rgba() access stencil_surf before checking
stencil_mask, what could cause a read of a uninitialized valued.

clear_depth_stencil()
	struct blorp_surf stencil_surf;
	...
	uint8_t stencil_mask = clear_stencil && stencil_res ? 0xff : 0;
	if (stencil_mask) {
		...
		iris_blorp_surf_for_resource(&stencil_surf);
	}
	...
	blorp_clear_depth_stencil(stencil_mask, stencil_surf)
		blorp_clear_stencil_as_rgba(stencil_mask, stencil)
			if (surf->surf->format ...)
				....

Just inverting the order and checking stencil_mask first in
blorp_clear_stencil_as_rgba() fixes the issue.

Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
Reviewed-by: Dylan Baker <dylan.c.baker@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27390>
This commit is contained in:
José Roberto de Souza
2024-01-31 06:03:24 -08:00
committed by Marge Bot
parent 90b6f84c5e
commit 44b4fee786
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/intel/blorp/blorp_clear.c
View File

@@ -755,15 +755,15 @@ blorp_clear_stencil_as_rgba(struct blorp_batch *batch,
{
assert((batch->flags & BLORP_BATCH_USE_COMPUTE) == 0);
/* Stencil mask support would require piles of shader magic */
if (stencil_mask != 0xff)
return false;
/* We only support separate W-tiled stencil for now */
if (surf->surf->format != ISL_FORMAT_R8_UINT ||
surf->surf->tiling != ISL_TILING_W)
return false;
/* Stencil mask support would require piles of shader magic */
if (stencil_mask != 0xff)
return false;
if (surf->surf->samples > 1) {
/* Adjust x0, y0, x1, and y1 to be in units of samples */
assert(surf->surf->msaa_layout == ISL_MSAA_LAYOUT_INTERLEAVED);