From 28894a30a17a84529be102b21118e55d6c9f23fa Mon Sep 17 00:00:00 2001 From: Li Qiang Date: Mon, 23 Jan 2017 02:44:03 -0500 Subject: [PATCH] gallium/tgsi: fix oob access in parse instruction When parsing texture instruction, it doesn't stop if the 'cur' is ',', the loop variable 'i' will also be increased and be used to index the 'inst.TexOffsets' array. This can lead an oob access issue. This patch avoid this. Signed-off-by: Li Qiang Signed-off-by: Dave Airlie --- src/gallium/auxiliary/tgsi/tgsi_text.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gallium/auxiliary/tgsi/tgsi_text.c b/src/gallium/auxiliary/tgsi/tgsi_text.c index b94d204..ee23971 100644 --- a/src/gallium/auxiliary/tgsi/tgsi_text.c +++ b/src/gallium/auxiliary/tgsi/tgsi_text.c @@ -1097,7 +1097,7 @@ parse_instruction( cur = ctx->cur; eat_opt_white( &cur ); - for (i = 0; inst.Instruction.Texture && *cur == ','; i++) { + for (i = 0; inst.Instruction.Texture && *cur == ',' && i < TGSI_FULL_MAX_TEX_OFFSETS; i++) { cur++; eat_opt_white( &cur ); ctx->cur = cur;