Fix for buffer overrun caused by ALLOC_STATE not having args surrounded by parenthesi...

diff --git a/src/mesa/drivers/dri/r300/r300_cmdbuf.c b/src/mesa/drivers/dri/r300/r300_cmdbuf.c
index c515b60..c9cd137 100644 (file)
--- a/src/mesa/drivers/dri/r300/r300_cmdbuf.c
+++ b/src/mesa/drivers/dri/r300/r300_cmdbuf.c
@@ -183,7 +183,6 @@ static __inline__ void r300DoEmitState(r300ContextPtr r300, GLboolean dirty)
        }
 }
 
-
 /**
  * Copy dirty hardware state atoms into the command buffer.
  *
@@ -197,7 +196,7 @@ void r300EmitState(r300ContextPtr r300)
 
        if (r300->cmdbuf.count_used && !r300->hw.is_dirty && !r300->hw.all_dirty)
                return;
-
+       
        /* To avoid going across the entire set of states multiple times, just check
         * for enough space for the case of emitting all state, and inline the
         * r300AllocCmdBuf code here without all the checks.
@@ -270,13 +269,13 @@ CHECK( vpu, vpucount(atom->cmd) ? (1 + vpucount(atom->cmd)*4) : 0 )
 
 #define ALLOC_STATE( ATOM, CHK, SZ, NM, IDX )                          \
    do {                                                                        \
-      r300->hw.ATOM.cmd_size = SZ;                                     \
-      r300->hw.ATOM.cmd = (uint32_t*)CALLOC(SZ * sizeof(uint32_t));    \
-      r300->hw.ATOM.name = NM;                                         \
-      r300->hw.ATOM.idx = IDX;                                         \
+      r300->hw.ATOM.cmd_size = (SZ);                                   \
+      r300->hw.ATOM.cmd = (uint32_t*)CALLOC((SZ) * sizeof(uint32_t));  \
+      r300->hw.ATOM.name = (NM);                                       \
+      r300->hw.ATOM.idx = (IDX);                                       \
       r300->hw.ATOM.check = check_##CHK;                               \
       r300->hw.ATOM.dirty = GL_FALSE;                                  \
-      r300->hw.max_state_size += SZ;                                   \
+      r300->hw.max_state_size += (SZ);                                 \
    } while (0)
 
 
@@ -287,7 +286,7 @@ CHECK( vpu, vpucount(atom->cmd) ? (1 + vpucount(atom->cmd)*4) : 0 )
 void r300InitCmdBuf(r300ContextPtr r300)
 {
        int size, i, mtu;
-
+       
        r300->hw.max_state_size = 0;
 
        mtu = r300->radeon.glCtx->Const.MaxTextureUnits;

diff --git a/src/mesa/drivers/dri/r300/r300_context.h b/src/mesa/drivers/dri/r300/r300_context.h
index 48822d3..18dc9d1 100644 (file)
--- a/src/mesa/drivers/dri/r300/r300_context.h
+++ b/src/mesa/drivers/dri/r300/r300_context.h
@@ -414,7 +414,6 @@ struct r300_hw_state {
 #ifdef EXP_C
        struct r300_state_atom lsf;     /* line stipple factor */
 #endif
-       struct r300_state_atom dummy[4];
        struct r300_state_atom unk4260; /* (4260) */
        struct r300_state_atom unk4274; /* (4274) */
        struct r300_state_atom unk4288; /* (4288) */
@@ -456,7 +455,6 @@ struct r300_hw_state {
        struct r300_state_atom vpi;     /* vp instructions */
        struct r300_state_atom vpp;     /* vp parameters */
        struct r300_state_atom vps;     /* vertex point size (?) */
-
                /* 8 texture units */
                /* the state is grouped by function and not by
                   texture unit. This makes single unit updates

diff --git a/src/mesa/drivers/dri/r300/r300_render.c b/src/mesa/drivers/dri/r300/r300_render.c
index 71977e7..2a57828 100644 (file)
--- a/src/mesa/drivers/dri/r300/r300_render.c
+++ b/src/mesa/drivers/dri/r300/r300_render.c
@@ -614,10 +614,10 @@ static GLboolean r300_run_vb_render(GLcontext *ctx,
    struct vertex_buffer *VB = &tnl->vb;
    int i, j;
    LOCAL_VARS
-
+   
        if (RADEON_DEBUG & DEBUG_PRIMS)
                fprintf(stderr, "%s\n", __FUNCTION__);
-
+       
 
        r300ReleaseArrays(ctx);
        r300EmitArrays(ctx, GL_FALSE);
@@ -634,7 +634,6 @@ static GLboolean r300_run_vb_render(GLcontext *ctx,
 
        reg_start(0x4f18,0);
        e32(0x00000003);
-
        r300EmitState(rmesa);
 
        rmesa->state.Elts = VB->Elts;

diff --git a/src/mesa/drivers/dri/r300/r300_state.c b/src/mesa/drivers/dri/r300/r300_state.c
index a811215..a386564 100644 (file)
--- a/src/mesa/drivers/dri/r300/r300_state.c
+++ b/src/mesa/drivers/dri/r300/r300_state.c
@@ -1337,7 +1337,7 @@ void r300_setup_textures(GLcontext *ctx)
        R300_STATECHANGE(r300, tex.offset);
        R300_STATECHANGE(r300, tex.unknown4);
        R300_STATECHANGE(r300, tex.border_color);
-
+       
        r300->state.texture.tc_count=0;
 
        r300->hw.txe.cmd[R300_TXE_ENABLE]=0x0;
@@ -1346,35 +1346,43 @@ void r300_setup_textures(GLcontext *ctx)
        if (RADEON_DEBUG & DEBUG_STATE)
                fprintf(stderr, "mtu=%d\n", mtu);
 
-       if(mtu>R300_MAX_TEXTURE_UNITS){
+       if(mtu > R300_MAX_TEXTURE_UNITS) {
                fprintf(stderr, "Aiiee ! mtu=%d is greater than R300_MAX_TEXTURE_UNITS=%d\n",
                        mtu, R300_MAX_TEXTURE_UNITS);
                exit(-1);
-               }
-       for(i=0;i<mtu;i++){
+       }
+       
+       for(i=0; i < mtu; i++) {
+               
                if( ((r300->state.render_inputs & (_TNL_BIT_TEX0<<i))!=0) != ((ctx->Texture.Unit[i].Enabled)!=0) ) {
                        WARN_ONCE("Mismatch between render_inputs and ctx->Texture.Unit[i].Enabled value.\n");
-                       }
-               if(r300->state.render_inputs & (_TNL_BIT_TEX0<<i)){
+               }
+               
+               if(r300->state.render_inputs & (_TNL_BIT_TEX0<<i)) {
                        t=r300->state.texture.unit[i].texobj;
                        //fprintf(stderr, "format=%08x\n", r300->state.texture.unit[i].format);
                        r300->state.texture.tc_count++;
-                       if(t==NULL){
+                       
+                       if(t == NULL){
                                fprintf(stderr, "Texture unit %d enabled, but corresponding texobj is NULL, using default object.\n", i);
                                //exit(-1);
                                t=&default_tex_obj;
-                               }
+                       }
+                       
                        //fprintf(stderr, "t->format=%08x\n", t->format);
-                       if((t->format & 0xffffff00)==0xffffff00){
+                       if((t->format & 0xffffff00)==0xffffff00) {
                                WARN_ONCE("unknown texture format (entry %x) encountered. Help me !\n", t->format & 0xff);
                                //fprintf(stderr, "t->format=%08x\n", t->format);
-                               }
+                       }
+                       
                        if (RADEON_DEBUG & DEBUG_STATE)
                                fprintf(stderr, "Activating texture unit %d\n", i);
                        max_texture_unit=i;
                        r300->hw.txe.cmd[R300_TXE_ENABLE]|=(1<<i);
-
+                       
                        r300->hw.tex.filter.cmd[R300_TEX_VALUE_0+i]=gen_fixed_filter(t->filter);
+                       r300->hw.tex.unknown1.cmd[R300_TEX_VALUE_0+i]=0x0;
+                       
                        /* No idea why linear filtered textures shake when puting random data */
                        /*r300->hw.tex.unknown1.cmd[R300_TEX_VALUE_0+i]=(rand()%0xffffffff) & (~0x1fff);*/
                        r300->hw.tex.size.cmd[R300_TEX_VALUE_0+i]=t->size;
@@ -1383,8 +1391,9 @@ void r300_setup_textures(GLcontext *ctx)
                        r300->hw.tex.offset.cmd[R300_TEX_VALUE_0+i]=r300->radeon.radeonScreen->fbLocation+t->offset;
                        r300->hw.tex.unknown4.cmd[R300_TEX_VALUE_0+i]=0x0;
                        r300->hw.tex.border_color.cmd[R300_TEX_VALUE_0+i]=t->pp_border_color;
-                       }
                }
+       }
+       
        ((drm_r300_cmd_header_t*)r300->hw.tex.filter.cmd)->unchecked_state.count = max_texture_unit+1;
        ((drm_r300_cmd_header_t*)r300->hw.tex.unknown1.cmd)->unchecked_state.count = max_texture_unit+1;
        ((drm_r300_cmd_header_t*)r300->hw.tex.size.cmd)->unchecked_state.count = max_texture_unit+1;