diff options
author | Sylwester Nawrocki <s.nawrocki@samsung.com> | 2021-05-20 17:50:41 +0200 |
---|---|---|
committer | Sylwester Nawrocki <s.nawrocki@samsung.com> | 2021-05-21 10:50:54 +0200 |
commit | c5b5c85e84c42b2f1c238f06d1f7dd8f22733bfc (patch) | |
tree | f5d4e58639177a18f644ee8b7a6e56b957e48fa1 | |
parent | 57bc2c5d5dc3981d8a0bbafa7ad75165caed98ea (diff) | |
download | emulator-yagl-c5b5c85e84c42b2f1c238f06d1f7dd8f22733bfc.tar.gz emulator-yagl-c5b5c85e84c42b2f1c238f06d1f7dd8f22733bfc.tar.bz2 emulator-yagl-c5b5c85e84c42b2f1c238f06d1f7dd8f22733bfc.zip |
Prevent an out of array bounds access in yagl_glsl_state_pp_condition_parse_add_op()submit/tizen/20210526.012442accepted/tizen/unified/20210531.130418
While moving higher or equal priority operations to expression stack in
yagl_glsl_state_pp_condition_parse_add_op function the state->pp_ops
array could be accessed with index -1. Reorder the while() expression
to avoid an out of array bounds access. This fixes an issue indicated
with SVACE warning:
* OVERFLOW_UNDER_CHECK: Buffer 'state->pp_ops' of size 64 accessed at
yagl_glsl_state.c:640 can overflow, since its index 'state->pp_current_op
- 1' can have value -1 that is out of range, as indicated by preceding
conditional expression at yagl_glsl_state.c:640.
[overflow] overflow at emulator-yagl-1.6/GLESv2/yagl_glsl_state.c:640
[check: Sub] Sub at emulator-yagl-1.6/GLESv2/yagl_glsl_state.c:640
[declaration] Shift at emulator-yagl-1.6/GLESv2/yagl_glsl_state.c:640
Change-Id: I2cb6a16ce6c3302f8a2dd4fe92bd8bfbec11c5ca
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
-rw-r--r-- | GLESv2/yagl_glsl_state.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/GLESv2/yagl_glsl_state.c b/GLESv2/yagl_glsl_state.c index 2c53835..c6e9f48 100644 --- a/GLESv2/yagl_glsl_state.c +++ b/GLESv2/yagl_glsl_state.c @@ -637,8 +637,8 @@ void yagl_glsl_state_pp_condition_parse_add_op(struct yagl_glsl_state *state, ya } // move higher or equal priority operations to expression stack - while (glsl_pp_op_prio[op] <= glsl_pp_op_prio[state->pp_ops[state->pp_current_op - 1]] && - state->pp_current_op > 0) { + while (state->pp_current_op > 0 && + glsl_pp_op_prio[op] <= glsl_pp_op_prio[state->pp_ops[state->pp_current_op - 1]]) { assert(state->pp_current_expr < YAGL_GLSL_PP_EXPRESSION_STACK_SIZE); state->pp_current_op--; state->pp_exprs[state->pp_current_expr].op = state->pp_ops[state->pp_current_op]; |