Skip to content

Commit 8ba666f

Browse files
committed
Improve DXIL BufferStore/TextureStore out of bounds handling
For texture data the maximum number of components to store comes from the format For non-texture data the maximum number of components is four which is then clamped to stop buffer overrun (by data size or offset)
1 parent 75aeb48 commit 8ba666f

File tree

1 file changed

+7
-5
lines changed

1 file changed

+7
-5
lines changed

renderdoc/driver/shaders/dxil/dxil_debug.cpp

+7-5
Original file line numberDiff line numberDiff line change
@@ -2160,14 +2160,15 @@ bool ThreadState::ExecuteInstruction(DebugAPIWrapper *apiWrapper,
21602160
{
21612161
data += dataOffset;
21622162
int numComps = fmt.numComps;
2163+
int maxNumComps = fmt.numComps;
21632164
// Clamp the number of components to read based on the amount of data in the buffer
21642165
if(!texData)
21652166
{
21662167
RDCASSERTNOTEQUAL(numElems, 0);
2167-
int maxNumComps = (int)((dataSize - dataOffset) / fmt.byteWidth);
2168-
fmt.numComps = RDCMIN(fmt.numComps, maxNumComps);
2168+
const int maxNumCompsData = (int)((dataSize - dataOffset) / fmt.byteWidth);
21692169
size_t maxOffset = (firstElem + numElems) * stride + structOffset;
2170-
maxNumComps = (int)((maxOffset - dataOffset) / fmt.byteWidth);
2170+
const int maxNumCompsOffset = (int)((maxOffset - dataOffset) / fmt.byteWidth);
2171+
maxNumComps = RDCMIN(maxNumCompsData, maxNumCompsOffset);
21712172
fmt.numComps = RDCMIN(fmt.numComps, maxNumComps);
21722173
}
21732174

@@ -2186,7 +2187,8 @@ bool ThreadState::ExecuteInstruction(DebugAPIWrapper *apiWrapper,
21862187
numComps = 0;
21872188
// Modify the correct components
21882189
const uint32_t valueStart = (dxOpCode == DXOp::TextureStore) ? 5 : 4;
2189-
for(uint32_t c = 0; c < (uint32_t)fmt.numComps; ++c)
2190+
const uint32_t numArgs = RDCMIN(4, maxNumComps);
2191+
for(uint32_t c = 0; c < numArgs; ++c)
21902192
{
21912193
if(GetShaderVariable(inst.args[c + valueStart], opCode, dxOpCode, arg))
21922194
{
@@ -2196,7 +2198,7 @@ bool ThreadState::ExecuteInstruction(DebugAPIWrapper *apiWrapper,
21962198
++numComps;
21972199
}
21982200
}
2199-
fmt.numComps = numComps;
2201+
fmt.numComps = RDCMIN(numComps, maxNumComps);
22002202
TypedUAVStore(fmt, (byte *)data, result.value);
22012203
}
22022204
}

0 commit comments

Comments
 (0)