Bug 74988

Summary:	Buffer overrun (segfault) decompressing ETC2 texture in GLBenchmark 3.0 Manhattan
Product:	Mesa	Reporter:	Courtney Goeltzenleuchter <courtney>
Component:	Mesa core	Assignee:	mesa-dev
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	medium
Version:	10.0
Hardware:	x86-64 (AMD64)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:

Description Courtney Goeltzenleuchter 2014-02-14 15:49:19 UTC

Saw intermittent segfault running GLBenchmark 3.0's Manhattan test. Narrowed issue down to writing outside the memory bounds of the texture when decompressing ETC2 data. Probably the root cause of bug 71002 (which has a nice repro) as well.

See patch mesa-add-bounds-checking-to-eliminate-buffer-overrun on mesadev for more details.

Comment 1 Tapani Pälli 2016-08-22 06:56:48 UTC

manhattan has been working well, this was fixed:
--- 8< ---
commit cb4ad1368551b64756c7b6e2007588e34739b188
Author: Courtney Goeltzenleuchter <courtney@lunarg.com>
Date:   Tue Apr 8 09:10:09 2014 -0600

    mesa: add bounds checking to eliminate buffer overrun
    
    Decompressing ETC2 textures was causing intermitent segfault
    by copying resulting 4x4 texel block to the destination texture
    regardless of the size of the destination texture. Issue found
    via application crash in GLBenchmark 3.0's Manhattan test.
    
    v2: add more detail comment. Compute limit outside inner loops.
    v3: add bugzilla reference
    v4: Correct cc syntax in commit log
    v5: really grab the right patch
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=74988
    Cc: "9.2 10.0 10.1" <mesa-stable@lists.freedesktop.org>
    Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
    Reviewed-by: Ian Romanick <ian.d.romanick@intel.com> [v1, suggested v2-3]

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.