Re: [Mesa-dev] [PATCH] intel/decoder: fix the possible out of bounds group_iter

2018-08-11 Thread asimiklit
Hi all, Andrey also opened a bug about this issue : https://bugs.freedesktop.org/show_bug.cgi?id=107544 It feels like it should be fixed on master though. get_length() shouldn't return -1 for structs anymore. We should probably return 1 at end of get_length() so that the decoder prints out "unk

Re: [Mesa-dev] [PATCH] intel/decoder: fix the possible out of bounds group_iter

2018-08-10 Thread Rafael Antognolli
On Fri, Aug 10, 2018 at 05:37:12PM +0100, Lionel Landwerlin wrote: > Andrey also opened a bug about this issue : > https://bugs.freedesktop.org/show_bug.cgi?id=107544 > > It feels like it should be fixed on master though. get_length() shouldn't > return -1 for structs anymore. > We should probably

Re: [Mesa-dev] [PATCH] intel/decoder: fix the possible out of bounds group_iter

2018-08-10 Thread Lionel Landwerlin
Andrey also opened a bug about this issue : https://bugs.freedesktop.org/show_bug.cgi?id=107544 It feels like it should be fixed on master though. get_length() shouldn't return -1 for structs anymore. We should probably return 1 at end of get_length() so that the decoder prints out "unknown in

Re: [Mesa-dev] [PATCH] intel/decoder: fix the possible out of bounds group_iter

2018-08-10 Thread Rafael Antognolli
On Thu, Aug 09, 2018 at 03:00:30PM +0300, andrey simiklit wrote: > Hi, > > Sorry I missed the main thought here. > The "gen_group_get_length" function returns int > but the "iter_group_offset_bits" function returns uint32_t > So uint32_t(int(-32)) = 0xFFE0U and it looks like unexpected behavio

Re: [Mesa-dev] [PATCH] intel/decoder: fix the possible out of bounds group_iter

2018-08-09 Thread andrey simiklit
Hi, Sorry I missed the main thought here. The "gen_group_get_length" function returns *int* but the "iter_group_offset_bits" function returns *uint32_t* So *uint32_t*(*int*(-32)) = *0xFFE0U* and it looks like unexpected behavior for me: iter_group_offset_bits(iter, iter->group_iter + 1) < *0xF

[Mesa-dev] [PATCH] intel/decoder: fix the possible out of bounds group_iter

2018-08-09 Thread Andrii Simiklit
The "gen_group_get_length" function can return a negative value and it can lead to the out of bounds group_iter. Signed-off-by: Andrii Simiklit --- src/intel/common/gen_decoder.c | 6 -- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/intel/common/gen_decoder.c b/src/intel/