From 4533a38fa8bb8ad24661adc2b67571546249a028 Mon Sep 17 00:00:00 2001 From: Eric Anholt Date: Thu, 10 Jan 2013 17:48:16 -0800 Subject: [PATCH] mesa: Fix out of bounds writes when uncompressing non-block-aligned ETC1. Fixes a crash in GLB2.1 offscreen on the glthread branch. Reviewed-by: Kenneth Graunke --- src/mesa/main/texcompress_etc_tmp.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/mesa/main/texcompress_etc_tmp.h b/src/mesa/main/texcompress_etc_tmp.h index 8bbb2cd..5497566 100644 --- a/src/mesa/main/texcompress_etc_tmp.h +++ b/src/mesa/main/texcompress_etc_tmp.h @@ -153,9 +153,9 @@ etc1_unpack_rgba8888(uint8_t *dst_row, for (x = 0; x < width; x+= bw) { etc1_parse_block(&block, src); - for (j = 0; j < bh; j++) { + for (j = 0; j < MIN2(bh, height - y); j++) { uint8_t *dst = dst_row + (y + j) * dst_stride + x * comps; - for (i = 0; i < bw; i++) { + for (i = 0; i < MIN2(bw, width - x); i++) { etc1_fetch_texel(&block, i, j, dst); dst[3] = 255; dst += comps; -- 2.7.4