← Back to branch summary

~ubuntu-branches/ubuntu/precise/mesa/precise-security

~ubuntu-branches/ubuntu/precise/mesa/precise-security

« back to all changes in this revision

Viewing changes to src/mesa/drivers/dri/radeon/radeon_maos_arrays.c

Committer: Package Import Robot
Author(s): Marc Deslauriers, Steve Beattie
Date: 2012-10-19 09:04:04 UTC
mfrom: (163.1.4 precise-proposed)
Revision ID: package-import@ubuntu.com-20121019090404-5zbjpsp6knv7zl3b

Tags: 8.0.4-0ubuntu0.2

https://launchpad.net/bugs/1046933

[ Steve Beattie ]
* SECURITY UPDATE: samplers array overflow (LP: #1046933)
  - debian/patches/50-CVE-2012-2864.patch: ensure that more than
    MAX_SAMPLERS are not used
  - CVE-2012-2864

files added:
debian/patches/117_nullptr_check_in_query_version.patch

debian/patches/118_glsl_initialize_samplers.patch

debian/patches/119_reduce_wm_thread_count_on_ivb_gt1.diff

debian/patches/50-CVE-2012-2864.patch

docs/relnotes-8.0.3.html

docs/relnotes-8.0.4.html

src/glx/apple/apple_glx_log.c

src/glx/apple/apple_glx_log.h

files removed:
debian/patches/117_intel_fix_hiz_null_dereference.patch

src/mesa/main/api_exec_es1_dispatch.h

src/mesa/main/api_exec_es1_remap_helper.h

src/mesa/main/api_exec_es2_dispatch.h

src/mesa/main/api_exec_es2_remap_helper.h

files modified:
Makefile

aclocal.m4

bin/mklib

configs/default

configure

configure.ac

debian/changelog

debian/patches/06_kfreebsd-ftbfs.diff

debian/patches/10-hurd-configure-tweaks.diff

debian/patches/100_no_abi_tag.patch

debian/patches/101_ubuntu_hidden_glname.patch

debian/patches/115_llvm_dynamic_linking.diff

debian/patches/116_use_shared_galliumcore.diff

debian/patches/13-llvm-config-pick-a-version.diff

debian/patches/series

docs/relnotes-8.0.2.html

docs/relnotes.html

include/pci_ids/i965_pci_ids.h

src/egl/main/eglimage.c

src/gallium/auxiliary/draw/draw_llvm.c

src/gallium/auxiliary/draw/draw_pipe_pstipple.c

src/gallium/auxiliary/draw/draw_pt.c

src/gallium/auxiliary/util/u_double_list.h

src/gallium/auxiliary/util/u_linkage.h

src/gallium/drivers/i915/i915_flush.c

src/gallium/drivers/i915/i915_screen.c

src/gallium/drivers/llvmpipe/lp_rast.c

src/gallium/drivers/nv50/nv50_pc_emit.c

src/gallium/drivers/nvfx/nvfx_fragprog.c

src/gallium/drivers/r300/compiler/radeon_program_alu.c

src/gallium/drivers/r300/r300_blit.c

src/gallium/drivers/r300/r300_context.c

src/gallium/drivers/r300/r300_context.h

src/gallium/drivers/r300/r300_emit.c

src/gallium/drivers/r300/r300_render.c

src/gallium/drivers/r300/r300_screen.c

src/gallium/drivers/r300/r300_state.c

src/gallium/drivers/r300/r300_vs.c

src/gallium/drivers/r300/r300_vs.h

src/gallium/drivers/r300/r300_vs_draw.c

src/gallium/drivers/r600/r600_shader.c

src/gallium/drivers/svga/include/svga_types.h

src/gallium/drivers/svga/svga_pipe_blit.c

src/gallium/drivers/svga/svga_pipe_draw.c

src/gallium/drivers/svga/svga_pipe_sampler.c

src/gallium/drivers/svga/svga_screen.c

src/gallium/drivers/svga/svga_state_tss.c

src/gallium/drivers/svga/svga_surface.c

src/gallium/state_trackers/dri/sw/drisw.c

src/gallium/state_trackers/vega/text.c

src/gallium/state_trackers/vega/vg_translate.c

src/gallium/targets/Makefile.xorg

src/gallium/targets/egl-static/egl_st.c

src/glsl/Android.mk

src/glsl/ast_to_hir.cpp

src/glsl/builtins/ir/acos.ir

src/glsl/builtins/tools/texture_builtins.py

src/glsl/glcpp/glcpp-lex.c

src/glsl/glcpp/glcpp-parse.c

src/glsl/glcpp/glcpp-parse.h

src/glsl/glsl_lexer.cpp

src/glsl/glsl_parser.cpp

src/glsl/glsl_parser.h

src/glsl/ir.h

src/glsl/ir_constant_expression.cpp

src/glsl/link_uniforms.cpp

src/glsl/linker.cpp

src/glsl/loop_analysis.cpp

src/glsl/loop_analysis.h

src/glsl/loop_unroll.cpp

src/glsl/ralloc.c

src/glsl/strtod.c

src/glu/sgi/libnurbs/internals/mapdesc.cc

src/glu/sgi/libnurbs/internals/nurbstess.cc

src/glx/apple/Makefile

src/glx/apple/apple_glx.c

src/glx/apple/apple_glx.h

src/glx/apple/apple_glx_context.c

src/glx/apple/apple_glx_drawable.c

src/glx/apple/apple_glx_surface.c

src/glx/compsize.c

src/glx/drisw_glx.c

src/glx/glxext.c

src/mapi/glapi/glapi_gentable.c

src/mesa/drivers/common/meta.c

src/mesa/drivers/dri/common/drirc

src/mesa/drivers/dri/i915/i830_state.c

src/mesa/drivers/dri/i915/i830_vtbl.c

src/mesa/drivers/dri/i915/i915_context.c

src/mesa/drivers/dri/i915/i915_context.h

src/mesa/drivers/dri/i915/i915_state.c

src/mesa/drivers/dri/i915/intel_render.c

src/mesa/drivers/dri/i915/intel_tris.c

src/mesa/drivers/dri/i965/brw_eu.c

src/mesa/drivers/dri/i965/brw_eu.h

src/mesa/drivers/dri/i965/brw_eu_emit.c

src/mesa/drivers/dri/i965/brw_fs.h

src/mesa/drivers/dri/i965/brw_fs_emit.cpp

src/mesa/drivers/dri/i965/brw_fs_visitor.cpp

src/mesa/drivers/dri/i965/brw_tex_layout.c

src/mesa/drivers/dri/i965/brw_vec4_visitor.cpp

src/mesa/drivers/dri/i965/brw_wm_surface_state.c

src/mesa/drivers/dri/i965/gen6_sampler_state.c

src/mesa/drivers/dri/intel/intel_chipset.h

src/mesa/drivers/dri/intel/intel_context.c

src/mesa/drivers/dri/intel/intel_extensions_es.c

src/mesa/drivers/dri/intel/intel_fbo.c

src/mesa/drivers/dri/intel/intel_fbo.h

src/mesa/drivers/dri/intel/intel_mipmap_tree.c

src/mesa/drivers/dri/intel/intel_pixel_bitmap.c

src/mesa/drivers/dri/intel/intel_regions.c

src/mesa/drivers/dri/intel/intel_tex.c

src/mesa/drivers/dri/intel/intel_tex_image.c

src/mesa/drivers/dri/intel/intel_tex_obj.h

src/mesa/drivers/dri/intel/intel_tex_validate.c

src/mesa/drivers/dri/r200/r200_maos_arrays.c

src/mesa/drivers/dri/radeon/radeon_maos_arrays.c

src/mesa/drivers/windows/gdi/wmesa.c

src/mesa/main/api_arrayelt.c

src/mesa/main/api_exec_es1.c

src/mesa/main/api_exec_es2.c

src/mesa/main/api_validate.c

src/mesa/main/attrib.c

src/mesa/main/bufferobj.c

src/mesa/main/dlist.c

src/mesa/main/extensions.c

src/mesa/main/fbobject.c

src/mesa/main/format_unpack.c

src/mesa/main/formats.c

src/mesa/main/image.c

src/mesa/main/image.h

src/mesa/main/imports.c

src/mesa/main/light.c

src/mesa/main/mipmap.c

src/mesa/main/readpix.c

src/mesa/main/shaderobj.c

src/mesa/main/texformat.c

src/mesa/main/texgetimage.c

src/mesa/main/teximage.c

src/mesa/main/transformfeedback.c

src/mesa/main/uniform_query.cpp

src/mesa/main/varray.c

src/mesa/main/version.c

src/mesa/main/version.h

src/mesa/program/ir_to_mesa.cpp

src/mesa/program/lex.yy.c

src/mesa/program/program_parse.tab.c

src/mesa/program/program_parse.tab.h

src/mesa/state_tracker/st_cb_drawpixels.c

src/mesa/state_tracker/st_cb_fbo.c

src/mesa/state_tracker/st_cb_texture.c

src/mesa/state_tracker/st_draw.c

src/mesa/state_tracker/st_extensions.c

src/mesa/state_tracker/st_format.c

src/mesa/state_tracker/st_gen_mipmap.c

src/mesa/state_tracker/st_glsl_to_tgsi.cpp

src/mesa/state_tracker/st_texture.c

src/mesa/swrast/s_aaline.c

src/mesa/swrast/s_aatriangle.c

src/mesa/swrast/s_blit.c

src/mesa/swrast/s_context.c

src/mesa/swrast/s_lines.c

src/mesa/swrast/s_texture.c

src/mesa/swrast/s_triangle.c

src/mesa/swrast/swrast.h

src/mesa/vbo/vbo_attrib_tmp.h

src/mesa/vbo/vbo_exec_api.c

src/mesa/vbo/vbo_exec_array.c

src/mesa/vbo/vbo_save_api.c

src/mesa/vbo/vbo_save_draw.c

tests/glx/Makefile.am

tests/glx/Makefile.in

tests/glx/fake_glx_screen.h

Show diffs side-by-side

added added

removed removed

src/mesa/drivers/dri/radeon/radeon_maos_arrays.c

66

66

aos->stride = 0;

67

67

}

68

68

else {

69

radeonAllocDmaRegion(rmesa, &aos->bo, &aos->offset, size * 4, 32);

69

radeonAllocDmaRegion(rmesa, &aos->bo, &aos->offset, size * count * 4, 32);

70

70

aos->stride = size;

71

71

}

72

72

Older »