commit 00555c4791ab055de3c7bf36efc607a38893efde
author Nicolas Capens <capn@google.com> Tue Jul 21 15:15:30 2015 -0400
committer Nicolas Capens <capn@google.com> Tue Jul 21 19:43:56 2015 +0000
tree 16ac88922e32577370c09d7016147fe326ba586a
parent b938c3ce2e6f24f71cf4ff52ec862bc85a91c0f0

Fix ETC1 decoding writing outside of internal buffer.

Bug 22632766

Change-Id: Ib2fccdd498a6da43af7bb945179b278026cdba18
Reviewed-on: https://swiftshader-review.googlesource.com/3744
Tested-by: Nicolas Capens <capn@google.com>
Reviewed-by: Alexis Hétu <sugoi@google.com>
Reviewed-by: Nicolas Capens <capn@google.com>

src/Renderer/Surface.cpp

diff --git a/src/Renderer/Surface.cpp b/src/Renderer/Surface.cpp
index 40aa920..3a0530e 100644
--- a/src/Renderer/Surface.cpp
+++ b/src/Renderer/Surface.cpp
@@ -2032,32 +2032,32 @@
 
 					if(source->flipbit)
 					{
-						for(int y = 0; y < 2; y++)
+						for(int j = 0; j < 2 && (y + j) < internal.height; j++)
 						{
-							color[0] = subblockColors0[source->getIndex(0, y)];
-							color[1] = subblockColors0[source->getIndex(1, y)];
-							color[2] = subblockColors0[source->getIndex(2, y)];
-							color[3] = subblockColors0[source->getIndex(3, y)];
+							if((x + 0) < internal.width) color[0] = subblockColors0[source->getIndex(0, j)];
+							if((x + 1) < internal.width) color[1] = subblockColors0[source->getIndex(1, j)];
+							if((x + 2) < internal.width) color[2] = subblockColors0[source->getIndex(2, j)];
+							if((x + 3) < internal.width) color[3] = subblockColors0[source->getIndex(3, j)];
 							color += internal.width;
 						}
 
-						for(int y = 2; y < 4; y++)
+						for(int j = 2; j < 4 && (y + j) < internal.height; j++)
 						{
-							color[0] = subblockColors1[source->getIndex(0, y)];
-							color[1] = subblockColors1[source->getIndex(1, y)];
-							color[2] = subblockColors1[source->getIndex(2, y)];
-							color[3] = subblockColors1[source->getIndex(3, y)];
+							if((x + 0) < internal.width) color[0] = subblockColors1[source->getIndex(0, j)];
+							if((x + 1) < internal.width) color[1] = subblockColors1[source->getIndex(1, j)];
+							if((x + 2) < internal.width) color[2] = subblockColors1[source->getIndex(2, j)];
+							if((x + 3) < internal.width) color[3] = subblockColors1[source->getIndex(3, j)];
 							color += internal.width;
 						}
 					}
 					else
 					{
-						for(int y = 0; y < 4; y++)
+						for(int j = 0; j < 4 && (y + j) < internal.height; j++)
 						{
-							color[0] = subblockColors0[source->getIndex(0, y)];
-							color[1] = subblockColors0[source->getIndex(1, y)];
-							color[2] = subblockColors1[source->getIndex(2, y)];
-							color[3] = subblockColors1[source->getIndex(3, y)];
+							if((x + 0) < internal.width) color[0] = subblockColors0[source->getIndex(0, j)];
+							if((x + 1) < internal.width) color[1] = subblockColors0[source->getIndex(1, j)];
+							if((x + 2) < internal.width) color[2] = subblockColors1[source->getIndex(2, j)];
+							if((x + 3) < internal.width) color[3] = subblockColors1[source->getIndex(3, j)];
 							color += internal.width;
 						}
 					}
@@ -2072,7 +2072,7 @@
 
 	unsigned int Surface::size(int width, int height, int depth, Format format)
 	{
-		// Dimensions rounded up to multiples of 4, used for DXTC formats
+		// Dimensions rounded up to multiples of 4, used for compressed formats
 		int width4 = (width + 3) & ~3;
 		int height4 = (height + 3) & ~3;