Skip to content
This repository was archived by the owner on Sep 4, 2024. It is now read-only.

Commit ce18d3d

Browse files
Patrick Lerda1ace
authored andcommitted
mesa/st: fix buffer overflow related to set_program_string()
For instance, this is triggered with "piglit/bin/ext_direct_state_access-named-program -auto -fbo": ==5695==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000050031 at pc 0x7f78dfca8d46 bp 0x7ffd9043b4a0 sp 0x7ffd9043ac50 READ of size 50 at 0x606000050031 thread T0 #0 0x7f78dfca8d45 (/usr/lib64/libasan.so.6+0x3fd45) android-rpi#1 0x7f78d450b18f in set_program_string ../src/mesa/main/arbprogram.c:385 android-rpi#2 0x7f78d3fdbd3e in execute_list ../src/mesa/main/dlist.c:13025 android-rpi#3 0x7f78d40c2564 in _mesa_CallList ../src/mesa/main/dlist.c:13451 #4 0x7f78d42f380a in _mesa_unmarshal_CallList ../src/mesa/main/glthread_list.c:43 #5 0x7f78d38e85c5 in glthread_unmarshal_batch ../src/mesa/main/glthread.c:122 #6 0x7f78d38ea20d in _mesa_glthread_finish ../src/mesa/main/glthread.c:382 #7 0x7f78d38ea20d in _mesa_glthread_finish ../src/mesa/main/glthread.c:347 #8 0x7f78d3d73f69 in _mesa_marshal_IsProgramARB src/mapi/glapi/gen/marshal_generated2.c:4256 Fixes: 0b196b4 ("mesa: don't compute the same SHA1 twice in glShaderSource") Signed-off-by: Patrick Lerda <[email protected]> Reviewed-by: Marek Olšák <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23295> (cherry picked from commit 44b960a)
1 parent 0fd5043 commit ce18d3d

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

.pick_status.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@
184184
"description": "mesa/st: fix buffer overflow related to set_program_string()",
185185
"nominated": true,
186186
"nomination_type": 1,
187-
"resolution": 0,
187+
"resolution": 1,
188188
"main_sha": null,
189189
"because_sha": "0b196b40a3ae88b822fc1ec98b3461469c7dec98"
190190
},

src/mesa/main/arbprogram.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -382,7 +382,7 @@ set_program_string(struct gl_program *prog, GLenum target, GLenum format, GLsize
382382
gl_shader_stage stage = _mesa_program_enum_to_shader_stage(target);
383383

384384
uint8_t sha1[SHA1_DIGEST_LENGTH];
385-
_mesa_sha1_compute(string, strlen(string), sha1);
385+
_mesa_sha1_compute(string, len, sha1);
386386

387387
/* Dump original shader source to MESA_SHADER_DUMP_PATH and replace
388388
* if corresponding entry found from MESA_SHADER_READ_PATH.

0 commit comments

Comments
 (0)