瀏覽代碼

Added checks for OOB transform cache access.

Branimir Karadžić 10 年之前
父節點
當前提交
a42cba815c
共有 1 個文件被更改,包括 9 次插入1 次删除
  1. 9 1
      src/bgfx_p.h

+ 9 - 1
src/bgfx_p.h

@@ -925,6 +925,10 @@ namespace bgfx
 
 
 		float* toPtr(uint32_t _cacheIdx)
 		float* toPtr(uint32_t _cacheIdx)
 		{
 		{
+			BX_CHECK(_cacheIdx < BGFX_CONFIG_MAX_MATRIX_CACHE, "Matrix cache out of bounds index %d (max: %d)"
+				, _cacheIdx
+				, BGFX_CONFIG_MAX_MATRIX_CACHE
+				);
 			return m_cache[_cacheIdx].un.val;
 			return m_cache[_cacheIdx].un.val;
 		}
 		}
 
 
@@ -1493,8 +1497,12 @@ namespace bgfx
 
 
 		void setTransform(uint32_t _cache, uint16_t _num)
 		void setTransform(uint32_t _cache, uint16_t _num)
 		{
 		{
+			BX_CHECK(_cache < BGFX_CONFIG_MAX_MATRIX_CACHE, "Matrix cache out of bounds index %d (max: %d)"
+				, _cache
+				, BGFX_CONFIG_MAX_MATRIX_CACHE
+				);
 			m_draw.m_matrix = _cache;
 			m_draw.m_matrix = _cache;
-			m_draw.m_num    = _num;
+			m_draw.m_num    = bx::uint32_min(_cache+_num, BGFX_CONFIG_MAX_MATRIX_CACHE-1) - _cache;
 		}
 		}
 
 
 		void setIndexBuffer(IndexBufferHandle _handle, uint32_t _firstIndex, uint32_t _numIndices)
 		void setIndexBuffer(IndexBufferHandle _handle, uint32_t _firstIndex, uint32_t _numIndices)