i915: out-of-bounds write in calc_live_regs()

i915: out-of-bounds write in calc_live_regs()

From a Coverity defect report.

src/mesa/drivers/dri/i915/i915_fragprog.c
   301  /*
   302   * TODO: consider moving this into core
   303   */
   304  static bool calc_live_regs( struct i915_fragment_program *p )
   305  {
   306      const struct gl_fragment_program *program = &p->FragProg;
   307      GLuint regsUsed = 0xffff0000;
-> 308      uint8_t live_components[16] = { 0, };
   309      GLint i;
   310
   311      for (i = program->Base.NumInstructions - 1; i >= 0; i--) {
   312          struct prog_instruction *inst =
&program->Base.Instructions[i];
   313          int opArgs = _mesa_num_inst_src_regs(inst->Opcode);
   314          int a;
   315
   316          /* Register is written to: unmark as live for this and
preceeding ops */
   317          if (inst->DstReg.File == PROGRAM_TEMPORARY) {
-> 318              if (inst->DstReg.Index > 16)
   319                 return false;
   320
-> 321              live_components[inst->DstReg.Index] &= ~inst->DstReg.WriteMask;
   322              if (live_components[inst->DstReg.Index] == 0)
   323                  regsUsed &= ~(1 << inst->DstReg.Index);
   324          }
   325
   326          for (a = 0; a < opArgs; a++) {
   327              /* Register is read from: mark as live for this and preceeding ops */
   328              if (inst->SrcReg[a].File == PROGRAM_TEMPORARY) {
   329                  unsigned c;
   330
   331                  if (inst->SrcReg[a].Index > 16)
   332                     return false;
   333
   334                  regsUsed |= 1 << inst->SrcReg[a].Index;
   335
   336                  for (c = 0; c < 4; c++) {
   337                      const unsigned field = GET_SWZ(inst->SrcReg[a].Swizzle, c);
   338
   339                      if (field <= SWIZZLE_W)
   340                          live_components[inst->SrcReg[a].Index] |= (1U << field);
   341                  }
   342              }
   343          }
   344
   345          p->usedRegs[i] = regsUsed;
   346      }

Reported-by: Vinson Lee <vlee@vmware.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=40022
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>