From bbd00844a2244cfe2702a5577a8d68f65877952a Mon Sep 17 00:00:00 2001
From: Andres Rodriguez <andresx7@gmail.com>
Date: Wed, 31 Jan 2018 12:22:41 -0500
Subject: [PATCH] mesa: remove usage of alloca in externalobjects.c v4

Don't want an overly large numBufferBarriers/numTextureBarriers to blow
up the stack.

v2: handle malloc errors
v3: fix patch
v4: initialize texObjs/bufObjs

Suggested-by: Emil Velikov <emil.velikov@collabora.com>
Signed-off-by: Andres Rodriguez <andresx7@gmail.com>
---
 src/mesa/main/externalobjects.c | 60 ++++++++++++++++++++++++++-------
 1 file changed, 48 insertions(+), 12 deletions(-)

diff --git a/src/mesa/main/externalobjects.c b/src/mesa/main/externalobjects.c
index 463debd268a..35545c2e556 100644
--- a/src/mesa/main/externalobjects.c
+++ b/src/mesa/main/externalobjects.c
@@ -716,12 +716,14 @@ _mesa_WaitSemaphoreEXT(GLuint semaphore,
                        const GLenum *srcLayouts)
 {
    GET_CURRENT_CONTEXT(ctx);
-   struct gl_semaphore_object *semObj;
-   struct gl_buffer_object **bufObjs;
-   struct gl_texture_object **texObjs;
+   struct gl_semaphore_object *semObj = NULL;
+   struct gl_buffer_object **bufObjs = NULL;
+   struct gl_texture_object **texObjs = NULL;
+
+   const char *func = "glWaitSemaphoreEXT";
 
    if (!ctx->Extensions.EXT_semaphore) {
-      _mesa_error(ctx, GL_INVALID_OPERATION, "glWaitSemaphoreEXT(unsupported)");
+      _mesa_error(ctx, GL_INVALID_OPERATION, "%s(unsupported)", func);
       return;
    }
 
@@ -734,12 +736,24 @@ _mesa_WaitSemaphoreEXT(GLuint semaphore,
    FLUSH_VERTICES(ctx, 0);
    FLUSH_CURRENT(ctx, 0);
 
-   bufObjs = alloca(sizeof(struct gl_buffer_object **) * numBufferBarriers);
+   bufObjs = malloc(sizeof(struct gl_buffer_object **) * numBufferBarriers);
+   if (!bufObjs) {
+      _mesa_error(ctx, GL_OUT_OF_MEMORY, "%s(numBufferBarriers=%u)",
+                  func, numBufferBarriers);
+      goto end;
+   }
+
    for (unsigned i = 0; i < numBufferBarriers; i++) {
       bufObjs[i] = _mesa_lookup_bufferobj(ctx, buffers[i]);
    }
 
-   texObjs = alloca(sizeof(struct gl_texture_object **) * numTextureBarriers);
+   texObjs = malloc(sizeof(struct gl_texture_object **) * numTextureBarriers);
+   if (!texObjs) {
+      _mesa_error(ctx, GL_OUT_OF_MEMORY, "%s(numTextureBarriers=%u)",
+                  func, numTextureBarriers);
+      goto end;
+   }
+
    for (unsigned i = 0; i < numTextureBarriers; i++) {
       texObjs[i] = _mesa_lookup_texture(ctx, textures[i]);
    }
@@ -748,6 +762,10 @@ _mesa_WaitSemaphoreEXT(GLuint semaphore,
                                          numBufferBarriers, bufObjs,
                                          numTextureBarriers, texObjs,
                                          srcLayouts);
+
+end:
+   free(bufObjs);
+   free(texObjs);
 }
 
 void GLAPIENTRY
@@ -759,12 +777,14 @@ _mesa_SignalSemaphoreEXT(GLuint semaphore,
                          const GLenum *dstLayouts)
 {
    GET_CURRENT_CONTEXT(ctx);
-   struct gl_semaphore_object *semObj;
-   struct gl_buffer_object **bufObjs;
-   struct gl_texture_object **texObjs;
+   struct gl_semaphore_object *semObj = NULL;
+   struct gl_buffer_object **bufObjs = NULL;
+   struct gl_texture_object **texObjs = NULL;
+
+   const char *func = "glSignalSemaphoreEXT";
 
    if (!ctx->Extensions.EXT_semaphore) {
-      _mesa_error(ctx, GL_INVALID_OPERATION, "glSignalSemaphoreEXT(unsupported)");
+      _mesa_error(ctx, GL_INVALID_OPERATION, "%s(unsupported)", func);
       return;
    }
 
@@ -777,12 +797,24 @@ _mesa_SignalSemaphoreEXT(GLuint semaphore,
    FLUSH_VERTICES(ctx, 0);
    FLUSH_CURRENT(ctx, 0);
 
-   bufObjs = alloca(sizeof(struct gl_buffer_object **) * numBufferBarriers);
+   bufObjs = malloc(sizeof(struct gl_buffer_object **) * numBufferBarriers);
+   if (!bufObjs) {
+      _mesa_error(ctx, GL_OUT_OF_MEMORY, "%s(numBufferBarriers=%u)",
+                  func, numBufferBarriers);
+      goto end;
+   }
+
    for (unsigned i = 0; i < numBufferBarriers; i++) {
       bufObjs[i] = _mesa_lookup_bufferobj(ctx, buffers[i]);
    }
 
-   texObjs = alloca(sizeof(struct gl_texture_object **) * numTextureBarriers);
+   texObjs = malloc(sizeof(struct gl_texture_object **) * numTextureBarriers);
+   if (!texObjs) {
+      _mesa_error(ctx, GL_OUT_OF_MEMORY, "%s(numTextureBarriers=%u)",
+                  func, numTextureBarriers);
+      goto end;
+   }
+
    for (unsigned i = 0; i < numTextureBarriers; i++) {
       texObjs[i] = _mesa_lookup_texture(ctx, textures[i]);
    }
@@ -791,6 +823,10 @@ _mesa_SignalSemaphoreEXT(GLuint semaphore,
                                            numBufferBarriers, bufObjs,
                                            numTextureBarriers, texObjs,
                                            dstLayouts);
+
+end:
+   free(bufObjs);
+   free(texObjs);
 }
 
 void GLAPIENTRY