Commit ec24bd22 authored by Marc-André Lureau's avatar Marc-André Lureau Committed by Dave Airlie
Browse files

decode: fix set_scissor_state bounds



Do not accept negative values for num & start.

Fix found thanks to american fuzzy lop.
Signed-off-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
parent 78f8994a
...@@ -762,7 +762,7 @@ static int vrend_decode_set_scissor_state(struct vrend_decode_ctx *ctx, int leng ...@@ -762,7 +762,7 @@ static int vrend_decode_set_scissor_state(struct vrend_decode_ctx *ctx, int leng
{ {
struct pipe_scissor_state ss[PIPE_MAX_VIEWPORTS]; struct pipe_scissor_state ss[PIPE_MAX_VIEWPORTS];
uint32_t temp; uint32_t temp;
int num_scissor, start_slot; uint32_t num_scissor, start_slot;
int s; int s;
if (length < 1) if (length < 1)
return EINVAL; return EINVAL;
......
...@@ -4972,8 +4972,8 @@ void vrend_set_blend_color(struct vrend_context *ctx, ...@@ -4972,8 +4972,8 @@ void vrend_set_blend_color(struct vrend_context *ctx,
} }
void vrend_set_scissor_state(struct vrend_context *ctx, void vrend_set_scissor_state(struct vrend_context *ctx,
int start_slot, uint32_t start_slot,
int num_scissor, uint32_t num_scissor,
struct pipe_scissor_state *ss) struct pipe_scissor_state *ss)
{ {
int i, idx; int i, idx;
......
...@@ -255,8 +255,8 @@ void vrend_renderer_blit(struct vrend_context *ctx, ...@@ -255,8 +255,8 @@ void vrend_renderer_blit(struct vrend_context *ctx,
void vrend_set_stencil_ref(struct vrend_context *ctx, struct pipe_stencil_ref *ref); void vrend_set_stencil_ref(struct vrend_context *ctx, struct pipe_stencil_ref *ref);
void vrend_set_blend_color(struct vrend_context *ctx, struct pipe_blend_color *color); void vrend_set_blend_color(struct vrend_context *ctx, struct pipe_blend_color *color);
void vrend_set_scissor_state(struct vrend_context *ctx, void vrend_set_scissor_state(struct vrend_context *ctx,
int start_slot, uint32_t start_slot,
int num_scissor, uint32_t num_scissor,
struct pipe_scissor_state *ss); struct pipe_scissor_state *ss);
void vrend_set_polygon_stipple(struct vrend_context *ctx, struct pipe_poly_stipple *ps); void vrend_set_polygon_stipple(struct vrend_context *ctx, struct pipe_poly_stipple *ps);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment