From: Eric Anholt <eric@anholt.net>
Date: Fri, 11 Jan 2013 01:48:16 +0000 (-0800)
Subject: mesa: Fix out of bounds writes when uncompressing non-block-aligned ETC1.
X-Git-Tag: mesa-9.1-rc1~279
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=4533a38fa8bb8ad24661adc2b67571546249a028;p=platform%2Fupstream%2Fmesa.git

mesa: Fix out of bounds writes when uncompressing non-block-aligned ETC1.

Fixes a crash in GLB2.1 offscreen on the glthread branch.

Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
---

diff --git a/src/mesa/main/texcompress_etc_tmp.h b/src/mesa/main/texcompress_etc_tmp.h
index 8bbb2cd..5497566 100644
--- a/src/mesa/main/texcompress_etc_tmp.h
+++ b/src/mesa/main/texcompress_etc_tmp.h
@@ -153,9 +153,9 @@ etc1_unpack_rgba8888(uint8_t *dst_row,
       for (x = 0; x < width; x+= bw) {
          etc1_parse_block(&block, src);
 
-         for (j = 0; j < bh; j++) {
+         for (j = 0; j < MIN2(bh, height - y); j++) {
             uint8_t *dst = dst_row + (y + j) * dst_stride + x * comps;
-            for (i = 0; i < bw; i++) {
+            for (i = 0; i < MIN2(bw, width - x); i++) {
                etc1_fetch_texel(&block, i, j, dst);
                dst[3] = 255;
                dst += comps;