← Back to branch summary

~ubuntu-branches/ubuntu/raring/mesa/raring-proposed

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2013-1872.patch

  • Committer: Package Import Robot
  • Author(s): Maarten Lankhorst
  • Date: 2013-06-24 13:44:48 UTC
  • mfrom: (183.2.1 raring-security)
  • Revision ID: package-import@ubuntu.com-20130624134448-42t32k68t0h3sx6m
Tags: 9.1.3-0ubuntu0.4
https://launchpad.net/bugs/1175533
* Added patches to add/fix Haswell pci-id's (LP: #1175533)
  - add-vlv-ids.diff
  - fix-hsw-gt3-names.diff
  - fix-missing-gt3-id.diff
  - add-more-reserved-hsw-ids.diff

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2013-1872.patch
 
1
Description: fix denial of service and possible code execution via
 
2
 out-of-bands access
 
3
Origin: backport, http://cgit.freedesktop.org/mesa/mesa/commit/?id=0677ea063cd96adefe87c1fb01ef7c66d905535b
 
4
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=59429
 
5
 
 
6
Index: mesa-9.1.3/src/mesa/drivers/dri/i965/brw_fs.cpp
 
7
===================================================================
 
8
--- mesa-9.1.3.orig/src/mesa/drivers/dri/i965/brw_fs.cpp        2013-06-18 13:53:12.200524978 -0400
 
9
+++ mesa-9.1.3/src/mesa/drivers/dri/i965/brw_fs.cpp     2013-06-18 13:53:12.196524978 -0400
 
10
@@ -786,6 +786,7 @@
 
11
                           import_uniforms_callback,
 
12
                           variable_ht);
 
13
    this->params_remap = v->params_remap;
 
14
+   this->nr_params_remap = v->nr_params_remap;
 
15
 }
 
16
 
 
17
 /* Our support for uniforms is piggy-backed on the struct
 
18
@@ -1458,6 +1459,7 @@
 
19
 {
 
20
    if (dispatch_width == 8) {
 
21
       this->params_remap = ralloc_array(mem_ctx, int, c->prog_data.nr_params);
 
22
+      this->nr_params_remap = c->prog_data.nr_params;
 
23
 
 
24
       for (unsigned int i = 0; i < c->prog_data.nr_params; i++)
 
25
         this->params_remap[i] = -1;
 
26
@@ -1472,7 +1474,14 @@
 
27
            if (inst->src[i].file != UNIFORM)
 
28
               continue;
 
29
 
 
30
-           assert(constant_nr < (int)c->prog_data.nr_params);
 
31
+           /* Section 5.11 of the OpenGL 4.3 spec says:
 
32
+            *
 
33
+            *     "Out-of-bounds reads return undefined values, which include
 
34
+            *     values from other variables of the active program or zero."
 
35
+            */
 
36
+           if (constant_nr < 0 || constant_nr >= (int)c->prog_data.nr_params) {
 
37
+              constant_nr = 0;
 
38
+           }
 
39
 
 
40
            /* For now, set this to non-negative.  We'll give it the
 
41
             * actual new number in a moment, in order to keep the
 
42
@@ -1520,6 +1529,10 @@
 
43
         if (inst->src[i].file != UNIFORM)
 
44
            continue;
 
45
 
 
46
+        /* as above alias to 0 */
 
47
+        if (constant_nr < 0 || constant_nr >= (int)this->nr_params_remap) {
 
48
+           constant_nr = 0;
 
49
+        }
 
50
         assert(this->params_remap[constant_nr] != -1);
 
51
         inst->src[i].reg = this->params_remap[constant_nr];
 
52
         inst->src[i].reg_offset = 0;
 
53
Index: mesa-9.1.3/src/mesa/drivers/dri/i965/brw_fs.h
 
54
===================================================================
 
55
--- mesa-9.1.3.orig/src/mesa/drivers/dri/i965/brw_fs.h  2013-06-18 13:53:12.200524978 -0400
 
56
+++ mesa-9.1.3/src/mesa/drivers/dri/i965/brw_fs.h       2013-06-18 13:53:12.196524978 -0400
 
57
@@ -431,6 +431,7 @@
 
58
     * uniform index.
 
59
     */
 
60
    int *params_remap;
 
61
+   int nr_params_remap;
 
62
 
 
63
    struct hash_table *variable_ht;
 
64
    fs_reg frag_depth;
 
65
Index: mesa-9.1.3/src/mesa/drivers/dri/i965/brw_fs_visitor.cpp
 
66
===================================================================
 
67
--- mesa-9.1.3.orig/src/mesa/drivers/dri/i965/brw_fs_visitor.cpp        2013-06-18 13:53:12.200524978 -0400
 
68
+++ mesa-9.1.3/src/mesa/drivers/dri/i965/brw_fs_visitor.cpp     2013-06-18 13:53:12.196524978 -0400
 
69
@@ -2273,6 +2273,9 @@
 
70
    this->virtual_grf_use = NULL;
 
71
    this->live_intervals_valid = false;
 
72
 
 
73
+   this->params_remap = NULL;
 
74
+   this->nr_params_remap = 0;
 
75
+
 
76
    this->force_uncompressed_stack = 0;
 
77
    this->force_sechalf_stack = 0;
 
78
 }