Commit 9033b269 authored by Marc-André Lureau's avatar Marc-André Lureau Committed by Dave Airlie

renderer: validate num_so_outputs

Avoid out-of-bound acces of array so_info.output.

Fix found thanks to american fuzzy lop.
Signed-off-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
parent 3767dbf1
......@@ -80,6 +80,9 @@ static int vrend_decode_create_shader(struct vrend_decode_ctx *ctx,
offlen = get_buf_entry(ctx, VIRGL_OBJ_SHADER_OFFSET);
num_so_outputs = get_buf_entry(ctx, VIRGL_OBJ_SHADER_SO_NUM_OUTPUTS);
if (num_so_outputs > PIPE_MAX_SO_OUTPUTS)
return EINVAL;
shader_offset = 6;
if (num_so_outputs) {
so_info.num_outputs = num_so_outputs;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment