Bug 74988 - Buffer overrun (segfault) decompressing ETC2 texture in GLBenchmark 3.0 Manhattan
Summary: Buffer overrun (segfault) decompressing ETC2 texture in GLBenchmark 3.0 Manha...
Status: RESOLVED FIXED
Alias: None
Product: Mesa
Classification: Unclassified
Component: Mesa core (show other bugs)
Version: 10.0
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: mesa-dev
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-14 15:49 UTC by Courtney Goeltzenleuchter
Modified: 2016-08-22 06:56 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Courtney Goeltzenleuchter 2014-02-14 15:49:19 UTC
Saw intermittent segfault running GLBenchmark 3.0's Manhattan test. Narrowed issue down to writing outside the memory bounds of the texture when decompressing ETC2 data. Probably the root cause of bug 71002 (which has a nice repro) as well.

See patch mesa-add-bounds-checking-to-eliminate-buffer-overrun on mesadev for more details.
Comment 1 Tapani Pälli 2016-08-22 06:56:48 UTC
manhattan has been working well, this was fixed:
--- 8< ---
commit cb4ad1368551b64756c7b6e2007588e34739b188
Author: Courtney Goeltzenleuchter <courtney@lunarg.com>
Date:   Tue Apr 8 09:10:09 2014 -0600

    mesa: add bounds checking to eliminate buffer overrun
    
    Decompressing ETC2 textures was causing intermitent segfault
    by copying resulting 4x4 texel block to the destination texture
    regardless of the size of the destination texture. Issue found
    via application crash in GLBenchmark 3.0's Manhattan test.
    
    v2: add more detail comment. Compute limit outside inner loops.
    v3: add bugzilla reference
    v4: Correct cc syntax in commit log
    v5: really grab the right patch
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=74988
    Cc: "9.2 10.0 10.1" <mesa-stable@lists.freedesktop.org>
    Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
    Reviewed-by: Ian Romanick <ian.d.romanick@intel.com> [v1, suggested v2-3]


bug/show.html.tmpl processed on Dec 05, 2016 at 08:25:53.
(provided by the Example extension).