nir/serialize: fix signed integer overflow
authorRhys Perry <pendingchaos02@gmail.com>
Wed, 27 Sep 2023 13:01:21 +0000 (14:01 +0100)
committerMarge Bot <emma+marge@anholt.net>
Wed, 25 Oct 2023 17:27:47 +0000 (17:27 +0000)
Fixes UBSan error:
src/compiler/nir/nir_serialize.c:1277:70: runtime error: left shift of 524287 by 13 places cannot be represented in type 'int'

Signed-off-by: Rhys Perry <pendingchaos02@gmail.com>
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25853>

src/compiler/nir/nir_serialize.c

index 5f6cec0..96c2ce4 100644 (file)
@@ -1271,10 +1271,14 @@ read_load_const(read_ctx *ctx, union packed_instr header)
    case load_const_scalar_lo_19bits_sext:
       switch (lc->def.bit_size) {
       case 64:
-         lc->value[0].i64 = ((int64_t)header.load_const.packed_value << 45) >> 45;
+         lc->value[0].u64 = header.load_const.packed_value;
+         if (lc->value[0].u64 >> 18)
+            lc->value[0].u64 |= UINT64_C(0xfffffffffff80000);
          break;
       case 32:
-         lc->value[0].i32 = ((int32_t)header.load_const.packed_value << 13) >> 13;
+         lc->value[0].u32 = header.load_const.packed_value;
+         if (lc->value[0].u32 >> 18)
+            lc->value[0].u32 |= 0xfff80000;
          break;
       case 16:
          lc->value[0].u16 = header.load_const.packed_value;