lux/citra
1
0
Fork 0
mirror of https://git.h3cjp.net/H3cJP/citra.git synced 2024-11-30 07:52:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

shader_recompiler: fix potential OOB access

Browse source 
Found by static analysis with PVS-Studio. Original check wasn't actually checking for OOB and would segfault in case of it.
This commit is contained in:
v1993 2022-01-17 12:45:34 +03:00
parent ca2d904770
commit a943600019
No known key found for this signature in database
GPG key ID: 9A30914F19F1D7C8
2 changed files with 8 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/shader_recompiler/backend/glsl/glsl_emit_context.cpp
View file

@ -458,9 +458,10 @@ void EmitContext::DefineGenericOutput(size_t index, u32 invocations) {
std::string definition{fmt::format("layout(location={}", index)}; std::string definition{fmt::format("layout(location={}", index)};
const u32 remainder{4 - element}; const u32 remainder{4 - element};
const TransformFeedbackVarying* xfb_varying{}; const TransformFeedbackVarying* xfb_varying{};
if (!runtime_info.xfb_varyings.empty()) { const size_t xfb_varying_index{base_index + element};
xfb_varying = &runtime_info.xfb_varyings[base_index + element]; if (xfb_varying_index < runtime_info.xfb_varyings.size()) {
xfb_varying = xfb_varying && xfb_varying->components > 0 ? xfb_varying : nullptr; xfb_varying = &runtime_info.xfb_varyings[xfb_varying_index];
xfb_varying = xfb_varying->components > 0 ? xfb_varying : nullptr;
} }
const u32 num_components{xfb_varying ? xfb_varying->components : remainder}; const u32 num_components{xfb_varying ? xfb_varying->components : remainder};
if (element > 0) { if (element > 0) {

7
src/shader_recompiler/backend/spirv/spirv_emit_context.cpp
View file

@ -164,9 +164,10 @@ void DefineGenericOutput(EmitContext& ctx, size_t index, std::optional<u32> invo
while (element < 4) { while (element < 4) {
const u32 remainder{4 - element}; const u32 remainder{4 - element};
const TransformFeedbackVarying* xfb_varying{}; const TransformFeedbackVarying* xfb_varying{};
if (!ctx.runtime_info.xfb_varyings.empty()) { const size_t xfb_varying_index{base_attr_index + element};
xfb_varying = &ctx.runtime_info.xfb_varyings[base_attr_index + element]; if (xfb_varying_index < ctx.runtime_info.xfb_varyings.size()) {
xfb_varying = xfb_varying && xfb_varying->components > 0 ? xfb_varying : nullptr; xfb_varying = &ctx.runtime_info.xfb_varyings[xfb_varying_index];
xfb_varying = xfb_varying->components > 0 ? xfb_varying : nullptr;
} }
const u32 num_components{xfb_varying ? xfb_varying->components : remainder}; const u32 num_components{xfb_varying ? xfb_varying->components : remainder};