Skip to content

OOB write to alloca for col-major cbuffer matrix subscript when rows > cols #7865

@tex3d

Description

@tex3d

Description
When you have a col_major (the default) matrix in a cbuffer with a higher number of rows than columns, the compiler produces invalid DXIL that writes to an out-of-bounds index of an alloca.

Steps to Reproduce
See: https://godbolt.org/z/6v877foo5

Actual Behavior
Compiled with validation disabled (-Vd) Produces:

%1 = alloca [2 x float], align 4
%9 = getelementptr inbounds [2 x float], [2 x float]* %1, i32 0, i32 2
store float %6, float* %9, align 4
; And, where %2 should be in range 0-2:
%10 = getelementptr inbounds [2 x float], [2 x float]* %1, i32 0, i32 %2

With validation enabled (without -Vd):

<source>:14:15: error: Access to out-of-bounds memory is disallowed.
note: at '%11 = getelementptr inbounds [2 x float], [2 x float]* %3, i32 0, i32 2' in block '#0' of function 'main'.
Validation failed.

Environment

  • DXC version: all
  • Host Operating System: all

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugBug, regression, crashneeds-triageAwaiting triage

    Type

    No type

    Projects

    Status

    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions