Commit Graph

56925 Commits

Author SHA1 Message Date
Andreas Boll
c0f7ccc136 build: Unify PACKAGE_VERSION on autotools, scons and Android
This patch unifies mesa's PACKAGE_VERSION on autotools, scons and
Android build systems.

Current behaviour is:
 - Autotools uses 9.2.0 as PACKAGE_VERSION
 - Scons and Android use 9.2-devel as PACKAGE_VERSION

With this patch all three build systems use 9.2.0-devel as
PACKAGE_VERSION.

Reviewed-by: Brian Paul <brianp@vmware.com>
2013-06-06 19:07:14 +02:00
Jonathan Gray
5bd808a2c7 radeon/winsys: correct RADEON_GEM_WAIT_IDLE use
RADEON_GEM_WAIT_IDLE is declared DRM_IOW but mesa
uses it with drmCommandWriteRead instead of drmCommandWrite
which leads to the ioctl being unmatched and returning an
error on at least OpenBSD.

Problem originally noticed in libdrm by Mark Kettenis.
Dave Airlie pointed out that mesa has the same issue.

Signed-off-by: Jonathan Gray <jsg@jsg.id.au>
2013-06-06 11:01:18 +02:00
Mike Stroyan
962204961d configure.ac: Build dricommon for gallium swrast
When building dri-swrast, use gallium_check_st to set HAVE_COMMON_DRI.
Commit 07f2dee7 added setting of HAVE_COMMON_DRI in gallium_check_st.
But the dri-swrast case did not use gallium_check_st.
So dri/common was still not built.

v2: set HAVE_COMMON_DRI=yes instead of using gallium_check_st

NOTE: This is a candidate for the 9.1 branch.
      (Depends on 7de78ce5 and 07f2dee)

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=61821
Signed-off-by: Andreas Boll <andreas.boll.dev@gmail.com>
2013-06-06 08:54:07 +02:00
Rodrigo Vivi
ce67fb4715 i965: Adding more reserved PCI IDs for Haswell.
At DDX commit Chris mentioned the tendency we have of finding out more
PCI IDs only when users report. So Let's add all new reserved Haswell IDs.

NOTE: This is a candidate for stable branches.

Bugzilla: http://bugs.freedesktop.org/show_bug.cgi?id=63701
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@gmail.com>
Acked-by: Kenneth Graunke <kenneth@whitecape.org>
2013-06-05 10:44:15 -07:00
Rico Schüller
3998cfa933 mesa: remove outdated version lines in comments
Signed-off-by: Brian Paul <brianp@vmware.com>
2013-06-05 08:54:27 -06:00
Richard Sandiford
7bdf1f2f1a gallium: System z support
The main change is to use MCJIT rather than the old JIT, which will never
be supported for System z.  The endianness part is by example since the
patch was tested on a glibc system.

Signed-off-by: Richard Sandiford <rsandifo@linux.vnet.ibm.com>
Signed-off-by: Brian Paul <brianp@vmware.com>
2013-06-05 08:36:24 -06:00
Roland Scheidegger
008fd03600 llvmpipe: improve alignment calculation for fetching/storing pixels
This was always doing per-pixel alignment which isn't necessary, except
for the buffer case (due to the per-element offset). The disabled code
for calculating it was incorrect because it assumed that always the full
block would be fetched, which may not be the case, so fix this up.
The original code failed for instance for r10g10b10a2 the alignment would
have been calculated as 4 (block_width) * 4 (bytes) so 16, but the actual
fetch may have only fetched 2 values at a time, hence only alignment 8 -
it is unclear what exactly would happen in this case (alignment larger
than size to fetch).
So just use the (already calculated) fetch size instead and get alignment
from that which should always work, no matter if fetching 1,2 or 4 pixels.

Reviewed-by: Jose Fonseca <jfonseca@vmware.com>
2013-06-05 00:29:47 +02:00
Roland Scheidegger
ffe2a1ca3c llvmpipe: reduce alignment requirement for 1d resources from 4x4 to 4x1
For rendering to buffers, we cannot have any y alignment.
So make sure that tile clear commands only clear up to the fb width/height,
not more (do this for all resources actually as clearing more seems
pointless for other resources too). For the jit fs function, skip execution
of the lower half of the fragment shader for the 4x4 stamp completely,
for depth/stencil only load/store the values from the first row
(replace other row with undef).
For the blend function, also only load half the values from fs output,
replace the rest with undefs so that everything still operates on the
full 4x4 block to keep code the same between 4x1 and 4x4 (except for
load/store of course which also needs to skip (store) or replace these
values with undefs (load))., at the cost of slightly less optimal code
being produced in some cases.
Also reduce 1d and 1d array alignment too, because they can be handled the
same as buffers so don't need to waste memory.

v2: don't try to run special blend code for 4x1, (very) slightly less
complexity if we just use the same code as for 4x4 which may or may not
make it easier to optimize in the future (as we care a lot more about 4x4
performance than 1d).

v2: don't use undef values for unused fs src outputs with llvm 3.1 as it
apparently can trigger a bug in llvm.

Reviewed-by: Jose Fonseca <jfonseca@vmware.com>
2013-06-05 00:29:47 +02:00
Roland Scheidegger
ef3e887084 llvmpipe: cleanup of generate_unswizzled_blend
Some parameters were used inconsistently, for instance not using
block_width/block_height/block_size for deferring number of pixels
but rather relying on guesses from the number of fragment shaders etc,
so fix this up (no actual change in behavior since the block size stays
fixed). (Though most of the code would work with different block_height,
with three exceptions, one being the hacked r11g11b10 conversions and
twiddle code which only work with block_height 2 not 1, and the last
one being blend vector type not being 128bit wide.)

Reviewed-by: Jose Fonseca <jfonseca@vmware.com>
2013-06-05 00:29:47 +02:00
Roland Scheidegger
44993c1808 gallivm: enhance special sse2 4x4f and 2x8f -> 1x16ub conversion
There's no good reason why it can't handle 2x4f->1x8ub, 1x4f->1x4ub and
1x8f->1x8ub cases, there might be legitimate reasons why we don't have
enough input vectors for a full destination vector, and using pack
intrinsics should still be much better than using generic conversion
(it looks like convert_alpha from the blend code might hit this though
I suspect it could be avoided).

v2: add another test vector format to lp_test_conv so this gets tested.

Reviewed-by: Jose Fonseca <jfonseca@vmware.com>
2013-06-05 00:29:46 +02:00
Roland Scheidegger
ce82523db9 gallivm: (trivial) fix lp_build_concat_n
The code was designed to handle no-op concat but failed (unless the
caller was using same pointer for src and dst).

Reviewed-by: Jose Fonseca <jfonseca@vmware.com>
2013-06-05 00:29:46 +02:00
Brian Paul
f270baf074 mesa: change MAX_PROGRAM_ADDRESS_REGS to 1, clamp to it in state tracker
We've never properly supported more than one address register.  There
isn't even a field in prog_src_register or prog_dst_register to indicate
which address register to use if RelAddr!=0.

In the state tracker, clamp MaxAddressRegs against MAX_PROGRAM_ADDRESS_REGS
since many gallium drivers do support more.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=65226

Reviewed-by: Jose Fonseca <jfonseca@vmware.com>
2013-06-04 13:29:38 -06:00
Paul Berry
2fd785d126 intel: Don't try to blorp or blit CopyTexSubImage(1D_ARRAY).
Blorp and the hardware blitter can't be used to implement
CopyTexSubImage when the image type is 1D_ARRAY, because of a
coordinate system mismatch (the Y coordinate in the source image is
supposed to be matched up to the Z coordinate in the destination
texture).

The hardware blitter path (intel_copy_texsubimage) contained a perf
debug warning for this case, but it failed to actually fall back.  The
blorp path didn't even check.

Fixes piglit test "copyteximage 1D_ARRAY".

Reviewed-by: Eric Anholt <eric@anholt.net>
2013-06-04 09:14:44 -07:00
Paul Berry
32d1f423bc i965/gen6+: Fix multisample assertions in CopyTexSubImage hw blitter path.
Commit 045612c (intel: Add an assert for glCopyTexSubImage() being
called on MSAA buffers) added an assertion to intel_copy_texsubimage()
to make sure that multisampling was not in use, based on the
assumption that glCopyTexSubImage() can't legally be used with
multisampling.

However, there is one case where glCopyTexSubImage() can legally be
used with multisampling: when the source buffer is a multisampled
window system buffer.  If the source and destination color formats
don't match, the blorp path will fail, so intel_copy_texsubimage()
will be called.  In this case, we need intel_copy_texsubimage() to
return false so that we fall back to meta to do the copy.  (The
multisampled source buffer won't cause a problem for the meta path,
because it uses glReadPixels, which forces a multisample resolve).

It's still safe to assert that the destination image is
single-sampled, because it's not legal to call glCopyTexSubImage() on
multisampled textures.

Fixes some failures with piglit tests "copyteximage
{1D,2D,CUBE,RECT,2D_ARRAY}" (with "samples=..." argument).

Reviewed-by: Eric Anholt <eric@anholt.net>
2013-06-04 09:14:40 -07:00
Vinson Lee
7bafd88c15 mesa: Prevent possible out-of-bounds read by save_SamplerParameterfv.
Fixes "Out-of-bounds access" defect reported by Coverity.

Signed-off-by: Vinson Lee <vlee@freedesktop.org>
Reviewed-by: Brian Paul <brianp@vmware.com>
2013-06-03 23:01:46 -07:00
Dave Airlie
0677ea063c i965: fix problem with constant out of bounds access (v3)
Okay I now understand why Frank would want to run away, this is
my attempt at fixing the CVE out of bounds access to constants
outside the range. This attempt converts any illegal constants
to constant 0 as per the GL spec, and is undefined behaviour.

A future patch should add some debug for users to find this out,
but this needs to be backported to stable branches.

CVE-2013-1872

v2: drop the last hunk which was a separate fix (now in master).
hopefully fix the indentations.

v3: don't fail piglit, the whole 8/16 dispatch stuff was over
my head, and I spent a while figuring it out, but this one is
definitely safe, one piglit pass extra on my Ironlake.

NOTE: This is a candidate for stable branches.

Signed-off-by: Dave Airlie <airlied@redhat.com>
2013-06-04 13:50:20 +10:00
Eric Anholt
bb525f1f11 intel: Fix copying of separate stencil data in glCopyTexSubImage().
We were copying the source stencil data onto the destination depth data.

Fixes piglit copyteximage other than 1D_ARRAY.

v2: Fix unintentional dropping of the "don't double-copy for packed
    depth/stencil" check.  While blorp is only supported on separate
    stencil hardware at the moment, hopefully that will change soon.
    Review by Jordan.

Reviewed-by: Jordan Justen <jordan.l.justen@intel.com>
2013-06-03 14:22:54 -07:00
Eric Anholt
c937aea3d1 meta: Fix temporary image type for float depth/stencil.
Fixes assertion failure in piglit copyteximage.

Reviewed-by: Chad Versace <chad.versace@linux.intel.com>
2013-06-03 13:47:19 -07:00
Eric Anholt
f96de8ad96 intel: Fix performance regression from miptree blit changes.
When making v2 of da2880bea0, I carefully
checked all of the calls in that commit to see that I'd updated them, but
forgot to update the new calls in the later commits such as
.e845c5cf7abce55759501a473459aff3bf25c9ca.  As a result, we were getting Y
tiled temporaries even though the whole point of the temporary was to
untile!

The steady state of the intro scene of lightsmark goes from 13 to 17 fps.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=65154
Reviewed-by: Chad Versace <chad.versace@linux.intel.com>
2013-06-03 13:47:18 -07:00
Carl Worth
610fe6da79 glcpp: Add test case for recently fixed loop-control underflow bug.
To trigger the bug, it suffices to have a line-continuation followed by
a newline and then a non-line-continuation backslash.

Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
2013-06-03 13:33:32 -07:00
Carl Worth
d8eeb1d330 glcpp: Fix post-decrement underflow in loop-control variable
This loop-control condition with a post-decrement operator would lead to
an underflow of collapsed_newlines. This in turn would cause a subsequent
execution of the loop to labor inordinately trying to return the loop-control
variable to a value of 0 again.

Fix this by dis-intertwining the test and the decrement.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=65112

Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
2013-06-03 13:33:31 -07:00
Chad Versace
7a9f4d3e71 i965: Fix glColorPointer(GL_FIXED)
When a gl_client_array is created with glColorPointer,
gl_client_array::Normalized is true. This caused the translation from the
gl_client_array's type to a BRW_SURFACEFORMAT to assertion fail.

Fixes the spinning cube's color in Android 4.2's ApiDemos.apk,
"Graphics > OpenGL ES".

Fixes assertion failure in mesa-demos/src/egl/opengles1/tri_x11 on Haswell
and Ivybridge:
  brw_draw_upload.c:287: get_surface_type: Assertion `0' failed.

No Piglit regressions on Haswell.

Note: This is a candidate for the 9.1 branch.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=42182
Issue: AXIA-2954
Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
Signed-off-by: Chad Versace <chad.versace@linux.intel.com>
2013-06-03 13:03:28 -07:00
Zack Rusin
e54c924a0e softpipe: draw_find_shader_output returns -1 on invalid outputs
It was changed from 0 to allow shader outputs at 0 that are
different from position.

Signed-off-by: Zack Rusin <zackr@vmware.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
2013-05-30 19:54:25 -04:00
Tom Stellard
124e1f91a7 radeonsi/compute: Upload work group, work item size in input buffer 2013-06-03 14:03:13 -04:00
Tom Stellard
3d831206a4 radeonsi/compute: Pass kernel arguments in a buffer v2
v2:
  - Fix memory leak in si_set_constant_buffer()
2013-06-03 14:03:08 -04:00
Tom Stellard
67e5c9ae0e radeonsi/compute: Implement un-binding of global buffers 2013-06-03 10:24:54 -04:00
Tom Stellard
d2472ceb92 radeonsi/compute: Support multiple kernels in a compute program 2013-06-03 10:24:54 -04:00
Tom Stellard
3f24190325 radeonsi/compute: Add missing PIPE_COMPUTE caps 2013-06-03 10:24:54 -04:00
Jordan Justen
c754f7a8fd i965 gen7: use SURFACE_STATE fields to select render level/layer
Rather than pointing the surface_state directly at a single
sub-image of the texture for rendering, we now point the
surface_state at the top level of the texture, and configure
the surface_state as needed based on this.

Signed-off-by: Jordan Justen <jordan.l.justen@intel.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
2013-06-02 20:39:38 -07:00
Jordan Justen
6bfd897fc4 mesa/texformat: add _mesa_tex_target_is_array function
Signed-off-by: Jordan Justen <jordan.l.justen@intel.com>
Reviewed-by: Paul Berry <stereotype441@gmail.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
2013-06-02 20:39:38 -07:00
Jordan Justen
6a5469cff9 intel: add layered parameter to update_renderbuffer_surface
Signed-off-by: Jordan Justen <jordan.l.justen@intel.com>
Reviewed-by: Paul Berry <stereotype441@gmail.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
2013-06-02 20:38:37 -07:00
Jordan Justen
8312caf673 intel_fbo: set gl_renderbuffer Depth field
Set the renderbuffer's Depth field to match the texture's
Depth when rendering to a texture.

Signed-off-by: Jordan Justen <jordan.l.justen@intel.com>
Reviewed-by: Paul Berry <stereotype441@gmail.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
2013-06-02 20:38:37 -07:00
Jordan Justen
a2d31371e9 intel: print image depth in debug message
Signed-off-by: Jordan Justen <jordan.l.justen@intel.com>
Reviewed-by: Paul Berry <stereotype441@gmail.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
2013-06-02 20:38:37 -07:00
Brian Paul
e20a2df401 mesa: handle missing read buffer in _mesa_get_color_read_format/type()
We were crashing when GL_READ_BUFFER == GL_NONE.  Check for NULL
pointers and reorganize the code.  The spec doesn't say which error
to generate in this situation, but NVIDIA raises GL_INVALID_OPERATION.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=65173
NOTE: This is a candidate for the stable branches.

Tested-by: Vedran Rodic <vrodic@gmail.com>
Reviewed-by: José Fonseca <jfonseca@vmware.com>
2013-06-02 18:12:07 -06:00
Brian Paul
dcc5b6bfb7 meta: move vertex array enables for mipmap generation
Before, on the second call to GenerateMipmap we were enabling two
vertex arrays for the current vertex array object, rather than
the private generate-mipmap vertex array object.  This caused
things to blow up elsewhere.

This patch moves the array enables into the block where the
generate-mipmap vertex array object is created, as we do in
the setup_ff_generate_mipmap() function.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=60518
NOTE: This is a candidate for the stable branches.

Tested-by: core13@gmx.net
Reviewed-by: José Fonseca <jfonseca@vmware.com>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
2013-06-02 18:06:17 -06:00
Brian Paul
8588350dc0 mesa: fix hodge podge indentation, update comments in texformat.c 2013-06-02 18:06:17 -06:00
Roland Scheidegger
6b53e2b038 gallium: add support for layered rendering
Since pipe_surface already has all the necessary fields no interface
changes are necessary except adding a new shader semantic value
(TGSI_SEMANTIC_LAYER).
(Note that what GL knows as "gl_Layer" variable d3d10 is naming
"RENDER_TARGET_ARRAY_INDEX".)

v2: drop cap bit (just tied to geometry shader), add docs.
2013-06-01 20:03:59 +02:00
Roland Scheidegger
458a9a0f85 gallivm: fix out-of-bounds access with mirror_clamp_to_edge address mode
Surprising this bug survived so long, we were missing a clamp (in the
linear filtering version).
(Valgrind complained a lot about invalid reads with piglit texwrap,
I've also seen spurios failures in this test which might have
happened due to this. Valgrind probably didn't complain before the
alignment reduction in llvmpipe to 4x4 since the test is using tiny
textures so the reads were still always well within allocated area.)
While here, also do an effective clamp (after half subtraction)
of [0,length-0.5] instead of [0, length-1] which saves an instruction
(the filtering weight could be different due to this, but only if
both texels point to the same max texel so it doesn't matter).
(Both changes are borrowed from PIPE_TEX_CLAMP_TO_EDGE case.)

Note: This is a candidate for the stable branches.

Reviewed-by: Jose Fonseca <jfonseca@vmware.com>
2013-06-01 20:03:59 +02:00
Roland Scheidegger
f51fc7a71c llvmpipe: fix bogus assertions for buffer surfaces
One of the assertion made no sense for buffer rendertargets
(due to the union), so drop it. (The same assertion is present already in
the path for texture surfaces later.).

v2: make assertion completely accurate (suggested by Jose).

Reviewed-by: Jose Fonseca <jfonseca@vmware.com>
2013-06-01 20:03:59 +02:00
Kenneth Graunke
4405ff4055 i965: Fix haswell_upload_cut_index when there's no index buffer.
brw->ib.type is reset to -1 at the start of each batch.  If there's no
index buffer, it won't get updated to a sensible value, resulting in
_mesa_primitive_restart_index's "Invalid index buffer type" assertion
tripping.

Fixes a regression since 7c87a3b5da.

NOTE: This is a candidate for the 9.1 branch (and should be squashed).
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=65195
Signed-off-by: Kenneth Graunke <kenneth@whitecape.org>
2013-05-31 21:54:49 -07:00
Roland Scheidegger
869c5d438f llvmpipe: reduce alignment requirement for resources from 64x64 to 4x4
The overallocation was very bad especially for things like 1d array
textures which got blown up by a factor of 64. (Even ordinary smallish
2d textures benefit a lot from this, a mipmapped 64x64 rgba8 texture
previously used 7*16kB = 112kB instead of now ~22kB.)
4x4 is chosen because this is the size the jit functions run on, so
making it smaller is going to be a bit more complicated.
It is actually not strictly 4x4 pixel, since we'd want to avoid situations
where different threads are rendering to the same cacheline so we keep
cacheline size alignment in x direction (often 64bytes).
To make this work introduce new task width/height parameters and make
sure clears don't clear the whole tile if it's a partial tile. Likewise,
the rasterizer may produce fragments outside the 4x4 blocks present in a
tile, so don't call the jit function for them.
This does not yet fix rendering to buffers (which cannot have any y
alignment at all), and 1d/1d array textures are still overallocated by a
factor of 4.

v2: replace magic number 4 with LP_RASTER_BLOCK_SIZE, fix size of buffers
allocated (needed in case we render to them).

Reviewed-by: Jose Fonseca <jfonseca@vmware.com>
2013-05-31 20:21:05 +02:00
Adam Jackson
e881c9a5dc llvmpipe: Remove x/y from cmd_bin
These were mostly just a waste of memory and cache pressure, and were
really only used for debugging.

This change reduces instruction count (as measured by callgrind's Ir
event) of gnome-shell-perf-tool on Ivybridge by 3.5% ± 0.015% (n=20).

Signed-off-by: Adam Jackson <ajax@redhat.com>
2013-05-31 20:21:05 +02:00
Vadim Girlin
eb4c992ea5 r600g/sb: fix broken assert
Signed-off-by: Vadim Girlin <vadimgirlin@gmail.com>
2013-05-31 22:11:42 +04:00
Andreas Boll
5ea43e6549 glapi: Add some missing static_dispatch="false" annotations to es_EXT.xml
This fixes the following build errors on powerpc:

  CC     glapi_dispatch.lo
  In file included from glapi_dispatch.c:90:0:
  ../../../../../src/mapi/glapi/glapitemp.h:1640:1: error: no previous
  prototype for 'glReadBufferNV' [-Werror=missing-prototypes]
  ../../../../../src/mapi/glapi/glapitemp.h:4198:1: error: no previous
  prototype for 'glDrawBuffersNV' [-Werror=missing-prototypes]
  ../../../../../src/mapi/glapi/glapitemp.h:6377:1: error: no previous
  prototype for 'glFlushMappedBufferRangeEXT'
  [-Werror=missing-prototypes]
  ../../../../../src/mapi/glapi/glapitemp.h:6389:1: error: no previous
  prototype for 'glMapBufferRangeEXT' [-Werror=missing-prototypes]
  ../../../../../src/mapi/glapi/glapitemp.h:6401:1: error: no previous
  prototype for 'glBindVertexArrayOES' [-Werror=missing-prototypes]
  ../../../../../src/mapi/glapi/glapitemp.h:6413:1: error: no previous
  prototype for 'glDeleteVertexArraysOES' [-Werror=missing-prototypes]
  ../../../../../src/mapi/glapi/glapitemp.h:6433:1: error: no previous
  prototype for 'glGenVertexArraysOES' [-Werror=missing-prototypes]
  ../../../../../src/mapi/glapi/glapitemp.h:6445:1: error: no previous
  prototype for 'glIsVertexArrayOES' [-Werror=missing-prototypes]

NOTE: This is a candidate for the 9.0 and 9.1 branches.

Reviewed-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
2013-05-31 17:18:57 +02:00
Vinson Lee
171199b2b7 mesa: Add missing break statement in _mesa_choose_tex_format.
Fixes "Missing break in switch" defect reported by Coverity.

Signed-off-by: Vinson Lee <vlee@freedesktop.org>
Reviewed-by: Brian Paul <brianp@vmware.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
2013-05-30 23:12:32 -07:00
Alan Coopersmith
306f630e67 integer overflow in XF86DRIGetClientDriverName() [CVE-2013-1993 2/2]
clientDriverNameLength is a CARD32 and needs to be bounds checked before
adding one to it to come up with the total size to allocate, to avoid
integer overflow leading to underallocation and writing data from the
network past the end of the allocated buffer.

NOTE: This is a candidate for stable release branches.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
2013-05-30 18:03:45 -07:00
Alan Coopersmith
2e5a268f18 integer overflow in XF86DRIOpenConnection() [CVE-2013-1993 1/2]
busIdStringLength is a CARD32 and needs to be bounds checked before adding
one to it to come up with the total size to allocate, to avoid integer
overflow leading to underallocation and writing data from the network past
the end of the allocated buffer.

NOTE: This is a candidate for stable release branches.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
2013-05-30 18:03:39 -07:00
Brian Paul
51498a3e71 mesa: fix error checking of DXT sRGB formats in _mesa_base_tex_format()
For formats such as GL_COMPRESSED_SRGB_S3TC_DXT1_EXT we need to
have both the GL_EXT_texture_sRGB and GL_EXT_texture_compression_s3tc
extensions.  This patch adds the missing check for the later.

Found when checking out https://bugs.freedesktop.org/show_bug.cgi?id=65173

NOTE: This is a candidate for the stable branches.

Reviewed-by: Jose Fonseca <jfonseca@vmware.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
2013-05-30 14:01:31 -06:00
Brian Paul
fb1785197f mesa: asst. whitespace, formatting fixes in teximage.c 2013-05-30 14:01:31 -06:00
Zack Rusin
978d5ed06b draw: fix vs/fs input/output mismatches
When we've changed draw_find_shader_output to return -1 instead
of 0 on non found attribs we broke the default behavior of
draw, which was to always redirect those to the first (0th) slot.
To preserve that behavior if draw_emit_vertex_attr notices a
mismatched vertex attrib, it just redirects it to the first slot
(instead of trying to use negative index in an array).

Signed-off-by: Zack Rusin <zackr@vmware.com>
Reviewed-by: José Fonseca <jfonseca@vmware.com>
2013-05-30 15:34:19 -04:00