Commit 3c0a03de authored by Marc-André Lureau's avatar Marc-André Lureau Committed by Dave Airlie

decode: check set_sampler_views args

Fix found thanks to american fuzzy lop.
Signed-off-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
parent 9be86b89
......@@ -275,6 +275,14 @@ static int vrend_decode_set_sampler_views(struct vrend_decode_ctx *ctx, uint16_t
num_samps = length - 2;
shader_type = get_buf_entry(ctx, VIRGL_SET_SAMPLER_VIEWS_SHADER_TYPE);
start_slot = get_buf_entry(ctx, VIRGL_SET_SAMPLER_VIEWS_START_SLOT);
if (shader_type >= PIPE_SHADER_TYPES)
return EINVAL;
if (num_samps > PIPE_MAX_SHADER_SAMPLER_VIEWS ||
start_slot > (PIPE_MAX_SHADER_SAMPLER_VIEWS - num_samps))
return EINVAL;
for (i = 0; i < num_samps; i++) {
uint32_t handle = get_buf_entry(ctx, VIRGL_SET_SAMPLER_VIEWS_V0_HANDLE + i);
vrend_set_single_sampler_view(ctx->grctx, shader_type, i + start_slot, handle);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment