r300: Fix out-of-bounds access in ntr_emit_store_output()

This patch resolves the problem by modifying the for loop condition
to ensure that it stays within the bounds of the array (i.e., i < 4)

Signed-off-by: Cong Liu <liucong2@kylinos.cn>
Reviewed-by: Pavel Ondračka <pavel.ondracka@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25419>

diff --git a/src/gallium/drivers/r300/compiler/nir_to_rc.c b/src/gallium/drivers/r300/compiler/nir_to_rc.c
index f71ecef..17f1594 100644 (file)
--- a/src/gallium/drivers/r300/compiler/nir_to_rc.c
+++ b/src/gallium/drivers/r300/compiler/nir_to_rc.c
@@ -1528,7 +1528,7 @@ ntr_emit_store_output(struct ntr_compile *c, nir_intrinsic_instr *instr)
    }
 
    uint8_t swizzle[4] = { 0, 0, 0, 0 };
-   for (int i = frac; i <= 4; i++) {
+   for (int i = frac; i < 4; i++) {
       if (out.WriteMask & (1 << i))
          swizzle[i] = i - frac;
    }