From 6a3004b9ae58dafd1ce995df78b0f3183827a59d Mon Sep 17 00:00:00 2001 From: Brian Paul Date: Thu, 7 May 2009 09:43:15 -0600 Subject: swrast: fix span clipping bug If a horizontal span of pixels was located at x < 0 we could sometimes read/write outside of renderbuffer bounds. --- src/mesa/swrast/s_span.c | 84 ++++++++++++++++++++++++++++++++++++------------ src/mesa/swrast/s_span.h | 9 ++++-- 2 files changed, 71 insertions(+), 22 deletions(-) (limited to 'src/mesa') diff --git a/src/mesa/swrast/s_span.c b/src/mesa/swrast/s_span.c index cfff82b051..fa8ca1d0e2 100644 --- a/src/mesa/swrast/s_span.c +++ b/src/mesa/swrast/s_span.c @@ -1,8 +1,9 @@ /* * Mesa 3-D graphics library - * Version: 7.1 + * Version: 7.5 * - * Copyright (C) 1999-2007 Brian Paul All Rights Reserved. + * Copyright (C) 1999-2008 Brian Paul All Rights Reserved. + * Copyright (C) 2009 VMware, Inc. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a * copy of this software and associated documentation files (the "Software"), @@ -188,10 +189,10 @@ interpolate_active_attribs(GLcontext *ctx, SWspan *span, GLbitfield attrMask) const GLfloat dv1dx = span->attrStepX[attr][1]; const GLfloat dv2dx = span->attrStepX[attr][2]; const GLfloat dv3dx = span->attrStepX[attr][3]; - GLfloat v0 = span->attrStart[attr][0]; - GLfloat v1 = span->attrStart[attr][1]; - GLfloat v2 = span->attrStart[attr][2]; - GLfloat v3 = span->attrStart[attr][3]; + GLfloat v0 = span->attrStart[attr][0] + span->leftClip * dv0dx; + GLfloat v1 = span->attrStart[attr][1] + span->leftClip * dv1dx; + GLfloat v2 = span->attrStart[attr][2] + span->leftClip * dv2dx; + GLfloat v3 = span->attrStart[attr][3] + span->leftClip * dv3dx; GLuint k; for (k = 0; k < span->end; k++) { const GLfloat invW = 1.0f / w; @@ -521,10 +522,10 @@ interpolate_texcoords(GLcontext *ctx, SWspan *span) const GLfloat drdx = span->attrStepX[attr][2]; const GLfloat dqdx = span->attrStepX[attr][3]; const GLfloat dqdy = span->attrStepY[attr][3]; - GLfloat s = span->attrStart[attr][0]; - GLfloat t = span->attrStart[attr][1]; - GLfloat r = span->attrStart[attr][2]; - GLfloat q = span->attrStart[attr][3]; + GLfloat s = span->attrStart[attr][0] + span->leftClip * dsdx; + GLfloat t = span->attrStart[attr][1] + span->leftClip * dtdx; + GLfloat r = span->attrStart[attr][2] + span->leftClip * drdx; + GLfloat q = span->attrStart[attr][3] + span->leftClip * dqdx; if (obj) { const struct gl_texture_image *img = obj->Image[0][obj->BaseLevel]; @@ -546,7 +547,7 @@ interpolate_texcoords(GLcontext *ctx, SWspan *span) || ctx->ATIFragmentShader._Enabled) { /* do perspective correction but don't divide s, t, r by q */ const GLfloat dwdx = span->attrStepX[FRAG_ATTRIB_WPOS][3]; - GLfloat w = span->attrStart[FRAG_ATTRIB_WPOS][3]; + GLfloat w = span->attrStart[FRAG_ATTRIB_WPOS][3] + span->leftClip * dwdx; for (i = 0; i < span->end; i++) { const GLfloat invW = 1.0F / w; texcoord[i][0] = s * invW; @@ -587,7 +588,7 @@ interpolate_texcoords(GLcontext *ctx, SWspan *span) ctx->ATIFragmentShader._Enabled) { /* do perspective correction but don't divide s, t, r by q */ const GLfloat dwdx = span->attrStepX[FRAG_ATTRIB_WPOS][3]; - GLfloat w = span->attrStart[FRAG_ATTRIB_WPOS][3]; + GLfloat w = span->attrStart[FRAG_ATTRIB_WPOS][3] + span->leftClip * dwdx; for (i = 0; i < span->end; i++) { const GLfloat invW = 1.0F / w; texcoord[i][0] = s * invW; @@ -660,8 +661,8 @@ interpolate_wpos(GLcontext *ctx, SWspan *span) } } - w = span->attrStart[FRAG_ATTRIB_WPOS][3]; dw = span->attrStepX[FRAG_ATTRIB_WPOS][3]; + w = span->attrStart[FRAG_ATTRIB_WPOS][3] + span->leftClip * dw; for (i = 0; i < span->end; i++) { wpos[i][2] = (GLfloat) span->array->z[i] * zScale; wpos[i][3] = w; @@ -726,6 +727,8 @@ clip_span( GLcontext *ctx, SWspan *span ) const GLint ymin = ctx->DrawBuffer->_Ymin; const GLint ymax = ctx->DrawBuffer->_Ymax; + span->leftClip = 0; + if (span->arrayMask & SPAN_XY) { /* arrays of x/y pixel coords */ const GLint *x = span->array->x; @@ -753,7 +756,7 @@ clip_span( GLcontext *ctx, SWspan *span ) /* horizontal span of pixels */ const GLint x = span->x; const GLint y = span->y; - const GLint n = span->end; + GLint n = span->end; /* Trivial rejection tests */ if (y < ymin || y >= ymax || x + n <= xmin || x >= xmax) { @@ -761,18 +764,44 @@ clip_span( GLcontext *ctx, SWspan *span ) return GL_FALSE; /* all pixels clipped */ } + /* Clip to right */ + if (x + n > xmax) { + ASSERT(x < xmax); + n = span->end = xmax - x; + } + /* Clip to the left */ if (x < xmin) { + const GLint leftClip = xmin - x; + GLuint i; + + ASSERT(leftClip > 0); ASSERT(x + n > xmin); + + /* Clip 'leftClip' pixels from the left side. + * The span->leftClip field will be applied when we interpolate + * fragment attributes. + * For arrays of values, shift them left. + */ + for (i = 0; i < FRAG_ATTRIB_MAX; i++) { + if (span->arrayAttribs & (1 << i)) { + /* shift array elements left by 'leftClip' */ + _mesa_memcpy(span->array->attribs[i], + span->array->attribs[i] + leftClip, + (n - leftClip) * 4 * sizeof(GLfloat)); + } + } + + span->leftClip = leftClip; + span->x = xmin; + span->end -= leftClip; span->writeAll = GL_FALSE; - _mesa_bzero(span->array->mask, (xmin - x) * sizeof(GLubyte)); } - /* Clip to right */ - if (x + n > xmax) { - ASSERT(x < xmax); - span->end = xmax - x; - } + ASSERT(span->x >= xmin); + ASSERT(span->x + span->end <= xmax); + ASSERT(span->y >= ymin); + ASSERT(span->y < ymax); return GL_TRUE; /* some pixels visible */ } @@ -818,6 +847,12 @@ _swrast_write_index_span( GLcontext *ctx, SWspan *span) } } + if (!(span->arrayMask & SPAN_MASK)) { + /* post-clip sanity check */ + assert(span->x >= 0); + assert(span->y >= 0); + } + /* Depth bounds test */ if (ctx->Depth.BoundsTest && fb->Visual.depthBits > 0) { if (!_swrast_depth_bounds_test(ctx, span)) { @@ -1284,6 +1319,7 @@ _swrast_write_rgba_span( GLcontext *ctx, SWspan *span) #ifdef DEBUG /* Make sure all fragments are within window bounds */ if (span->arrayMask & SPAN_XY) { + /* array of pixel locations */ GLuint i; for (i = 0; i < span->end; i++) { if (span->array->mask[i]) { @@ -1321,6 +1357,14 @@ _swrast_write_rgba_span( GLcontext *ctx, SWspan *span) if (!(span->arrayMask & SPAN_Z)) _swrast_span_interpolate_z(ctx, span); + if ((span->arrayMask & SPAN_XY) == 0) { + if (span->x < fb->_Xmin || span->x + span->end > fb->_Xmax || + span->y < fb->_Ymin || span->y >= fb->_Ymax) { + printf("Bad span clipping at %d, %d\n", span->x, span->y); + return; + } + } + if (ctx->Stencil._Enabled) { /* Combined Z/stencil tests */ if (!_swrast_stencil_and_ztest_span(ctx, span)) { diff --git a/src/mesa/swrast/s_span.h b/src/mesa/swrast/s_span.h index c4b47df58f..0eabae20e0 100644 --- a/src/mesa/swrast/s_span.h +++ b/src/mesa/swrast/s_span.h @@ -1,8 +1,9 @@ /* * Mesa 3-D graphics library - * Version: 6.5 + * Version: 7.5 * - * Copyright (C) 1999-2005 Brian Paul All Rights Reserved. + * Copyright (C) 1999-2008 Brian Paul All Rights Reserved. + * Copyright (C) 2009 VMware, Inc. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a * copy of this software and associated documentation files (the "Software"), @@ -106,6 +107,9 @@ typedef struct sw_span /** Number of fragments in the span */ GLuint end; + /** for clipping left edge of spans */ + GLuint leftClip; + /** This flag indicates that mask[] array is effectively filled with ones */ GLboolean writeAll; @@ -165,6 +169,7 @@ do { \ (S).arrayMask = 0x0; \ (S).arrayAttribs = 0x0; \ (S).end = 0; \ + (S).leftClip = 0; \ (S).facing = 0; \ (S).array = SWRAST_CONTEXT(ctx)->SpanArrays; \ } while (0) -- cgit v1.2.3