lvella/suyu
1
0
Fork 0
forked from suyu/suyu
Code Pull requests Activity

astc_decoder: Fix out of bounds memory access

Browse source 
resolves a crash with some anamolous textures found in Astral Chain.
This commit is contained in:
ameerj 2021-01-19 19:54:28 -05:00
parent 20eb368e14
commit c7553abe89
1 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/video_core/host_shaders/astc_decoder.comp
View file

@ -339,6 +339,9 @@ uint Select2DPartition(uint seed, uint x, uint y, uint partition_count, bool sma
} }
uint ReadBit() { uint ReadBit() {
if (current_index >= local_buff.length()) {
return 0;
}
uint bit = bitfieldExtract(local_buff[current_index], bitsread, 1); uint bit = bitfieldExtract(local_buff[current_index], bitsread, 1);
bitsread++; bitsread++;
total_bitsread++; total_bitsread++;
@ -1170,12 +1173,17 @@ void DecompressBlock(ivec3 coord, uint block_index) {
plane_selector_bits = 2; plane_selector_bits = 2;
} }
remaining_bits -= plane_selector_bits; remaining_bits -= plane_selector_bits;
if (remaining_bits > 128) {
// Bad data, more remaining bits than 4 bytes
// return early
return;
}
// Read color data... // Read color data...
uint color_data_bits = remaining_bits; uint color_data_bits = remaining_bits;
while (remaining_bits > 0) { while (remaining_bits > 0) {
uint nb = min(remaining_bits, 8); int nb = int(min(remaining_bits, 8U));
uint b = StreamBits(nb); uint b = StreamBits(nb);
color_endpoint_data[ced_pointer] = uint(bitfieldExtract(b, 0, 8)); color_endpoint_data[ced_pointer] = uint(bitfieldExtract(b, 0, nb));
ced_pointer++; ced_pointer++;
remaining_bits -= nb; remaining_bits -= nb;
} }