Bug 6498

Summary:	Mesa can and does crash with CLAMP_TO_BORDER set as a texture wrap mode
Product:	Mesa	Reporter:	James Burns <James.Burns>
Component:	Mesa core	Assignee:	mesa-dev
Status:	RESOLVED FIXED	QA Contact:
Severity:	critical
Priority:	highest
Version:	6.4
Hardware:	All
OS:	All
Whiteboard:
i915 platform:		i915 features:

Description James Burns 2006-04-05 00:14:26 UTC

The following code segement is from sample_depth_texture from s_texture.c(6.4)
lines 2378-2380 or s_texfilter.c(6.5) line 2286-2288:

COMPUTE_NEAREST_TEXEL_LOCATION(tObj->WrapS, texcoords[i][0], width, col);
COMPUTE_NEAREST_TEXEL_LOCATION(tObj->WrapT, texcoords[i][1], height, row);
img->FetchTexelf(img, col, row, 0, &depthSample);

Depending on the wrap mode defined for the texture object, it is possible for
row or column to return from the COMPUTE_NEAREST_TEXEL_LOCATION as -1.  When
used in the fetch method, a segementation fault occurs.  (E.g.  This could occur
if CLAMP_TO_BORDER is selected as the wrap mode, depending on the input texture
coordinate.) 

It is recommended that the depthSample local variable be initialized during
instantiation, and the fetch method only be called if both row and col are
non-negative.

NOTE: This bug is also present in 6.5; however the reporting dialog does not
allow the report of errors for this version of Mesa yet.

Comment 1 Brian Paul 2006-04-05 13:24:22 UTC

Fixed in CVS.  We now use the texture border color's red component when the
texcoord row, column is in the border area.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.