commit 030b541b8e0038fd2c99b72ccb4fd74d7c51f363
author Alexis Hetu <sugoi@google.com> Mon Jan 17 17:53:26 2022 -0500
committer swiftshader-scoped@luci-project-accounts.iam.gserviceaccount.com <swiftshader-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Jan 18 17:27:23 2022 +0000
tree 5479d7572a453853ea321f5cae2427d427f58cdf
parent bd73512f3dd13f6b51aa512803eaab3e41cf3656

Fix robust OOB store accesses

Negative dynamic offsets were causing OOB memory accesses.
Added a check that the offsets are >= 0 to solve this.

Bug: angleproject:6906
Change-Id: If93d762a18e2541ca257d7f6908f54310d9e58b4
Reviewed-on: https://swiftshader-review.googlesource.com/c/SwiftShader/+/61448
Reviewed-by: Nicolas Capens <nicolascapens@google.com>
Tested-by: Alexis Hétu <sugoi@google.com>
Commit-Queue: Alexis Hétu <sugoi@google.com>
Kokoro-Result: kokoro <noreply+kokoro@google.com>

src/Pipeline/ShaderCore.cpp

diff --git a/src/Pipeline/ShaderCore.cpp b/src/Pipeline/ShaderCore.cpp
index 38d590d..7b4c77b 100644
--- a/src/Pipeline/ShaderCore.cpp
+++ b/src/Pipeline/ShaderCore.cpp
@@ -959,7 +959,7 @@
 		    (staticOffsets[3] + accessSize - 1 < staticLimit) ? 0xffffffff : 0);
 	}
 
-	return CmpLT(offsets() + SIMD::Int(accessSize - 1), SIMD::Int(limit()));
+	return CmpGE(offsets(), SIMD::Int(0)) & CmpLT(offsets() + SIMD::Int(accessSize - 1), SIMD::Int(limit()));
 }
 
 bool Pointer::isStaticallyInBounds(unsigned int accessSize, OutOfBoundsBehavior robustness) const