diff options
| author | Axel Davy <axel.davy@ens.fr> | 2015-07-25 17:54:26 +0200 |
|---|---|---|
| committer | Axel Davy <axel.davy@ens.fr> | 2015-08-21 22:21:48 +0200 |
| commit | 1a747094ed0ab32541936dd18931f382901affe6 (patch) | |
| tree | d07d5e799f10b80a20b2083a177c0e1cd8078f5b | |
| parent | f15ff98e2c53f6ce62443b24e3a9cf79c60ddff7 (diff) | |
st/nine: Fix the number of texture stages
The number of texture stages is 8.
'tex_stage' array was too big, and thus
the checks with 'Elements(state->ff.tex_stage)' were passing,
causing some invalid API calls to pass, and crash because of
out of bounds write since bumpmap_vars was just the correct size.
Signed-off-by: Axel Davy <axel.davy@ens.fr>
| -rw-r--r-- | src/gallium/state_trackers/nine/nine_state.h | 8 | ||||
| -rw-r--r-- | src/gallium/state_trackers/nine/stateblock9.c | 2 |
2 files changed, 6 insertions, 4 deletions
diff --git a/src/gallium/state_trackers/nine/nine_state.h b/src/gallium/state_trackers/nine/nine_state.h index 4351e3e6ec7..b34da70ef48 100644 --- a/src/gallium/state_trackers/nine/nine_state.h +++ b/src/gallium/state_trackers/nine/nine_state.h @@ -102,6 +102,8 @@ NINE_MAX_CONST_I * 4 * sizeof(int)) +#define NINE_MAX_TEXTURE_STAGES 8 + #define NINE_MAX_LIGHTS 65536 #define NINE_MAX_LIGHTS_ACTIVE 8 @@ -156,7 +158,7 @@ struct nine_state int ps_const_i[NINE_MAX_CONST_I][4]; BOOL ps_const_b[NINE_MAX_CONST_B]; float *ps_lconstf_temp; - uint32_t bumpmap_vars[48]; + uint32_t bumpmap_vars[6 * NINE_MAX_TEXTURE_STAGES]; struct { void *vs; @@ -191,7 +193,7 @@ struct nine_state struct { struct { uint32_t group; - uint32_t tex_stage[NINE_MAX_SAMPLERS][(NINED3DTSS_COUNT + 31) / 32]; + uint32_t tex_stage[NINE_MAX_TEXTURE_STAGES][(NINED3DTSS_COUNT + 31) / 32]; uint32_t transform[(NINED3DTS_COUNT + 31) / 32]; } changed; @@ -208,7 +210,7 @@ struct nine_state D3DMATERIAL9 material; - DWORD tex_stage[NINE_MAX_SAMPLERS][NINED3DTSS_COUNT]; + DWORD tex_stage[NINE_MAX_TEXTURE_STAGES][NINED3DTSS_COUNT]; } ff; uint32_t commit; diff --git a/src/gallium/state_trackers/nine/stateblock9.c b/src/gallium/state_trackers/nine/stateblock9.c index 032b9ffcbf0..6d6e1be0b7f 100644 --- a/src/gallium/state_trackers/nine/stateblock9.c +++ b/src/gallium/state_trackers/nine/stateblock9.c @@ -251,7 +251,7 @@ nine_state_copy_common(struct nine_state *dst, dst->ff.material = src->ff.material; if (mask->changed.group & NINE_STATE_FF_PSSTAGES) { - for (s = 0; s < NINE_MAX_SAMPLERS; ++s) { + for (s = 0; s < NINE_MAX_TEXTURE_STAGES; ++s) { for (i = 0; i < NINED3DTSS_COUNT; ++i) if (mask->ff.changed.tex_stage[s][i / 32] & (1 << (i % 32))) dst->ff.tex_stage[s][i] = src->ff.tex_stage[s][i]; |