[Bug 102552] Null dereference due to not checking return value of util_format_description

[Bug 102552] Null dereference due to not checking return value of util_format_description

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 776 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=102552

            Bug ID: 102552
           Summary: Null dereference due to not checking return value of
                    util_format_description
           Product: Mesa
           Version: git
          Hardware: x86-64 (AMD64)
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: medium
         Component: Drivers/Gallium/r600
          Assignee: dri-devel@lists.freedesktop.org
          Reporter: pauk.denis@gmail.com
        QA Contact: dri-devel@lists.freedesktop.org

In case unsupported format util_format_description return NULL, and dereference
will produce segffault.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 2156 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 102552] Null dereference due to not checking return value of util_format_description

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 636 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=102552

Pauk Denis <pauk.denis@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pauk.denis@gmail.com

--- Comment #1 from Pauk Denis <pauk.denis@gmail.com> ---
Created attachment 133978
  --> https://bugs.freedesktop.org/attachment.cgi?id=133978&action=edit
gallium/{r600,radeonsi}: Fix segfault with color format

Possible fix for r600/radionsi

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 2332 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 102552] Null dereference due to not checking return value of util_format_description

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 310 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=102552

--- Comment #2 from Ilia Mirkin <imirkin@alum.mit.edu> ---
What format is this happening with? There should be a description for every
format, maybe except PIPE_FORMAT_NONE.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 1147 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 102552] Null dereference due to not checking return value of util_format_description

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 620 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=102552

--- Comment #3 from Pauk Denis <pauk.denis@gmail.com> ---
I have found this behaiviour because of error in my code when some time
is_format_supported called with uninitialized value and had value >
PIPE_FORMAT_COUNT. 

With check like:
-----
for(int i=0; i<PIPE_FORMAT_COUNT; i++) {
   pscreen->is_format_supported(pscreen, i, PIPE_TEXTURE_2D, 0,
PIPE_BIND_SAMPLER_VIEW);
   }
-----

Such code has possible issues with: 73, 78, 79, 80, 81, 86 (holes in enum
pipe_format).

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 1465 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 102552] Null dereference due to not checking return value of util_format_description

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 555 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=102552

--- Comment #4 from Ilia Mirkin <imirkin@alum.mit.edu> ---
Oh interesting. I think some of those formats were removed recently. I wonder
if such call sites should be fixed. Nouveau calls util_format_is_supported up
high in is_format_supported, I suspect that gets it out of trouble.

Either way, is_format_supported or its callers should be fixed, not utility
functions like util_format_get_first_non_void_channel.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 1392 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 102552] Null dereference due to not checking return value of util_format_description

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 946 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=102552

Pauk Denis <pauk.denis@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #133978|0                           |1
        is obsolete|                            |

--- Comment #5 from Pauk Denis <pauk.denis@gmail.com> ---
Created attachment 134056
  --> https://bugs.freedesktop.org/attachment.cgi?id=134056&action=edit
Updated version with changes related only to *_supported functions.

I have deleted all changes not realted to *_supported functions.

Change in src/gallium/auxiliary/util/u_format.c:util_format_is_supported -
check that value of format in correct range (<PIPE_FORMAT_COUNT).

Changes in src/gallium/drivers/{r600,radeonsi} - check for holes in format
values.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 2642 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 102552] Null dereference due to not checking return value of util_format_description

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 650 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=102552

Pauk Denis <pauk.denis@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #134056|0                           |1
        is obsolete|                            |

--- Comment #6 from Pauk Denis <pauk.denis@gmail.com> ---
Created attachment 134129
  --> https://bugs.freedesktop.org/attachment.cgi?id=134129&action=edit
gallium/{r600,radeonsi}: Fix segfault with color format

Fix radeonsi

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 2319 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 102552] Null dereference due to not checking return value of util_format_description

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 394 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=102552

--- Comment #7 from Pauk Denis <pauk.denis@gmail.com> ---
In 'si_is_sampler_format_supported': 'util_format_get_first_non_void_channel' -
tried to check 'struct util_format_description' before 'si_translate_texformat'
call so we have segfault before check.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 1230 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 102552] Null dereference due to not checking return value of util_format_description

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 305 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=102552

--- Comment #8 from Pauk Denis <pauk.denis@gmail.com> ---
I have sent version patch to mesa-dev@lists.freedesktop.org.

https://patchwork.freedesktop.org/series/30086/

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 1263 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 102552] Null dereference due to not checking return value of util_format_description

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 591 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=102552

Pauk Denis <pauk.denis@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #9 from Pauk Denis <pauk.denis@gmail.com> ---
Fixed in
https://cgit.freedesktop.org/mesa/mesa/commit/?id=74d2456491fbd96eb3fb99cf8dd3595b223c2065

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 2275 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel