From 984dcfc59faa1e50dd9e9aa59e3e80582157792f Mon Sep 17 00:00:00 2001 From: Tony Wasserka Date: Tue, 15 Sep 2020 13:07:16 +0200 Subject: [PATCH] radv: Avoid calling memcpy with null pointers Vulkan allows for these input pointers to be null when the respective object count is zero. Calling memcpy with null pointers is undefined, so they are guarded with a check for the legit use pattern now. Reviewed-by: Samuel Pitoiset Part-of: --- src/amd/vulkan/radv_device.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/src/amd/vulkan/radv_device.c b/src/amd/vulkan/radv_device.c index d28bb0ede7a..26c232fc230 100644 --- a/src/amd/vulkan/radv_device.c +++ b/src/amd/vulkan/radv_device.c @@ -4333,18 +4333,24 @@ radv_create_deferred_submission(struct radv_queue *queue, deferred->cmd_buffers = (void*)(deferred + 1); deferred->cmd_buffer_count = submission->cmd_buffer_count; - memcpy(deferred->cmd_buffers, submission->cmd_buffers, - submission->cmd_buffer_count * sizeof(*deferred->cmd_buffers)); + if (submission->cmd_buffer_count) { + memcpy(deferred->cmd_buffers, submission->cmd_buffers, + submission->cmd_buffer_count * sizeof(*deferred->cmd_buffers)); + } deferred->buffer_binds = (void*)(deferred->cmd_buffers + submission->cmd_buffer_count); deferred->buffer_bind_count = submission->buffer_bind_count; - memcpy(deferred->buffer_binds, submission->buffer_binds, - submission->buffer_bind_count * sizeof(*deferred->buffer_binds)); + if (submission->buffer_bind_count) { + memcpy(deferred->buffer_binds, submission->buffer_binds, + submission->buffer_bind_count * sizeof(*deferred->buffer_binds)); + } deferred->image_opaque_binds = (void*)(deferred->buffer_binds + submission->buffer_bind_count); deferred->image_opaque_bind_count = submission->image_opaque_bind_count; - memcpy(deferred->image_opaque_binds, submission->image_opaque_binds, - submission->image_opaque_bind_count * sizeof(*deferred->image_opaque_binds)); + if (submission->image_opaque_bind_count) { + memcpy(deferred->image_opaque_binds, submission->image_opaque_binds, + submission->image_opaque_bind_count * sizeof(*deferred->image_opaque_binds)); + } deferred->flush_caches = submission->flush_caches; deferred->wait_dst_stage_mask = submission->wait_dst_stage_mask; @@ -4382,9 +4388,13 @@ radv_create_deferred_submission(struct radv_queue *queue, } deferred->wait_values = (void*)(deferred->temporary_semaphore_parts + temporary_count); - memcpy(deferred->wait_values, submission->wait_values, submission->wait_value_count * sizeof(uint64_t)); + if (submission->wait_value_count) { + memcpy(deferred->wait_values, submission->wait_values, submission->wait_value_count * sizeof(uint64_t)); + } deferred->signal_values = deferred->wait_values + submission->wait_value_count; - memcpy(deferred->signal_values, submission->signal_values, submission->signal_value_count * sizeof(uint64_t)); + if (submission->signal_value_count) { + memcpy(deferred->signal_values, submission->signal_values, submission->signal_value_count * sizeof(uint64_t)); + } deferred->wait_nodes = (void*)(deferred->signal_values + submission->signal_value_count); /* This is worst-case. radv_queue_enqueue_submission will fill in further, but this