Skip to content

Commit

Permalink
Improve DXIL BufferStore/TextureStore out of bounds handling
Browse files Browse the repository at this point in the history
For texture data the maximum number of components to store comes from the format
For non-texture data the maximum number of components is four which is then clamped to stop buffer overrun (by data size or offset)
  • Loading branch information
Zorro666 committed Jan 2, 2025
1 parent 75aeb48 commit 8ba666f
Showing 1 changed file with 7 additions and 5 deletions.
12 changes: 7 additions & 5 deletions renderdoc/driver/shaders/dxil/dxil_debug.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -2160,14 +2160,15 @@ bool ThreadState::ExecuteInstruction(DebugAPIWrapper *apiWrapper,
{
data += dataOffset;
int numComps = fmt.numComps;
int maxNumComps = fmt.numComps;
// Clamp the number of components to read based on the amount of data in the buffer
if(!texData)
{
RDCASSERTNOTEQUAL(numElems, 0);
int maxNumComps = (int)((dataSize - dataOffset) / fmt.byteWidth);
fmt.numComps = RDCMIN(fmt.numComps, maxNumComps);
const int maxNumCompsData = (int)((dataSize - dataOffset) / fmt.byteWidth);
size_t maxOffset = (firstElem + numElems) * stride + structOffset;
maxNumComps = (int)((maxOffset - dataOffset) / fmt.byteWidth);
const int maxNumCompsOffset = (int)((maxOffset - dataOffset) / fmt.byteWidth);
maxNumComps = RDCMIN(maxNumCompsData, maxNumCompsOffset);
fmt.numComps = RDCMIN(fmt.numComps, maxNumComps);
}

Expand All @@ -2186,7 +2187,8 @@ bool ThreadState::ExecuteInstruction(DebugAPIWrapper *apiWrapper,
numComps = 0;
// Modify the correct components
const uint32_t valueStart = (dxOpCode == DXOp::TextureStore) ? 5 : 4;
for(uint32_t c = 0; c < (uint32_t)fmt.numComps; ++c)
const uint32_t numArgs = RDCMIN(4, maxNumComps);
for(uint32_t c = 0; c < numArgs; ++c)
{
if(GetShaderVariable(inst.args[c + valueStart], opCode, dxOpCode, arg))
{
Expand All @@ -2196,7 +2198,7 @@ bool ThreadState::ExecuteInstruction(DebugAPIWrapper *apiWrapper,
++numComps;
}
}
fmt.numComps = numComps;
fmt.numComps = RDCMIN(numComps, maxNumComps);
TypedUAVStore(fmt, (byte *)data, result.value);
}
}
Expand Down

0 comments on commit 8ba666f

Please sign in to comment.