From abe193a4076820290a1055994266e74d46117f58 Mon Sep 17 00:00:00 2001 From: Martijn Courteaux Date: Tue, 28 Jan 2025 18:58:22 +0100 Subject: [PATCH] Fix UniformBuffer UB regarding UniformType::Enum with extra bits. (#3398) --- src/bgfx.cpp | 4 ++-- src/bgfx_p.h | 8 ++++---- src/renderer_d3d11.cpp | 6 +++--- src/renderer_d3d12.cpp | 6 +++--- src/renderer_gl.cpp | 2 +- src/renderer_mtl.mm | 6 +++--- src/renderer_vk.cpp | 6 +++--- 7 files changed, 19 insertions(+), 19 deletions(-) diff --git a/src/bgfx.cpp b/src/bgfx.cpp index 009964f36b..902f76e8c0 100644 --- a/src/bgfx.cpp +++ b/src/bgfx.cpp @@ -1522,7 +1522,7 @@ namespace bgfx write(_value, g_uniformTypeSize[_type]*_num); } - void UniformBuffer::writeUniformHandle(UniformType::Enum _type, uint16_t _loc, UniformHandle _handle, uint16_t _num) + void UniformBuffer::writeUniformHandle(uint8_t _type, uint16_t _loc, UniformHandle _handle, uint16_t _num) { const uint32_t opcode = encodeOpcode(_type, _loc, _num, false); write(opcode); @@ -2520,7 +2520,7 @@ namespace bgfx break; } - UniformType::Enum type; + uint8_t type; uint16_t loc; uint16_t num; uint16_t copy; diff --git a/src/bgfx_p.h b/src/bgfx_p.h index 436db4b134..651d585faf 100644 --- a/src/bgfx_p.h +++ b/src/bgfx_p.h @@ -1508,7 +1508,7 @@ namespace bgfx } } - static uint32_t encodeOpcode(UniformType::Enum _type, uint16_t _loc, uint16_t _num, uint16_t _copy) + static uint32_t encodeOpcode(uint8_t _type, uint16_t _loc, uint16_t _num, uint16_t _copy) { const uint32_t type = _type << kConstantOpcodeTypeShift; const uint32_t loc = _loc << kConstantOpcodeLocShift; @@ -1517,14 +1517,14 @@ namespace bgfx return type|loc|num|copy; } - static void decodeOpcode(uint32_t _opcode, UniformType::Enum& _type, uint16_t& _loc, uint16_t& _num, uint16_t& _copy) + static void decodeOpcode(uint32_t _opcode, uint8_t& _type, uint16_t& _loc, uint16_t& _num, uint16_t& _copy) { const uint32_t type = (_opcode&kConstantOpcodeTypeMask) >> kConstantOpcodeTypeShift; const uint32_t loc = (_opcode&kConstantOpcodeLocMask ) >> kConstantOpcodeLocShift; const uint32_t num = (_opcode&kConstantOpcodeNumMask ) >> kConstantOpcodeNumShift; const uint32_t copy = (_opcode&kConstantOpcodeCopyMask); // >> kConstantOpcodeCopyShift; - _type = (UniformType::Enum)(type); + _type = (uint8_t )type; _copy = (uint16_t)copy; _num = (uint16_t)num; _loc = (uint16_t)loc; @@ -1583,7 +1583,7 @@ namespace bgfx } void writeUniform(UniformType::Enum _type, uint16_t _loc, const void* _value, uint16_t _num = 1); - void writeUniformHandle(UniformType::Enum _type, uint16_t _loc, UniformHandle _handle, uint16_t _num = 1); + void writeUniformHandle(uint8_t _type, uint16_t _loc, UniformHandle _handle, uint16_t _num = 1); void writeMarker(const bx::StringView& _name); private: diff --git a/src/renderer_d3d11.cpp b/src/renderer_d3d11.cpp index ecd4085c8f..66e5eb73ca 100644 --- a/src/renderer_d3d11.cpp +++ b/src/renderer_d3d11.cpp @@ -3377,7 +3377,7 @@ namespace bgfx { namespace d3d11 break; } - UniformType::Enum type; + uint8_t type; uint16_t loc; uint16_t num; uint16_t copy; @@ -3395,7 +3395,7 @@ namespace bgfx { namespace d3d11 data = (const char*)m_uniforms[handle.idx]; } - switch ( (uint32_t)type) + switch (type) { case UniformType::Mat3: case UniformType::Mat3|kUniformFragmentBit: @@ -4190,7 +4190,7 @@ namespace bgfx { namespace d3d11 } kind = "user"; - m_constantBuffer->writeUniformHandle( (UniformType::Enum)(type|fragmentBit), regIndex, info->m_handle, regCount); + m_constantBuffer->writeUniformHandle(type|fragmentBit, regIndex, info->m_handle, regCount); } } else diff --git a/src/renderer_d3d12.cpp b/src/renderer_d3d12.cpp index 03d41083db..4f95612956 100644 --- a/src/renderer_d3d12.cpp +++ b/src/renderer_d3d12.cpp @@ -3384,7 +3384,7 @@ namespace bgfx { namespace d3d12 break; } - UniformType::Enum type; + uint8_t type; uint16_t loc; uint16_t num; uint16_t copy; @@ -3402,7 +3402,7 @@ namespace bgfx { namespace d3d12 data = (const char*)m_uniforms[handle.idx]; } - switch ( (uint32_t)type) + switch (type) { case UniformType::Mat3: case UniformType::Mat3|kUniformFragmentBit: @@ -4834,7 +4834,7 @@ namespace bgfx { namespace d3d12 } kind = "user"; - m_constantBuffer->writeUniformHandle( (UniformType::Enum)(type|fragmentBit), regIndex, info->m_handle, regCount); + m_constantBuffer->writeUniformHandle(type|fragmentBit, regIndex, info->m_handle, regCount); } } else diff --git a/src/renderer_gl.cpp b/src/renderer_gl.cpp index 9145e27fd5..92836f76a8 100644 --- a/src/renderer_gl.cpp +++ b/src/renderer_gl.cpp @@ -4420,7 +4420,7 @@ namespace bgfx { namespace gl break; } - UniformType::Enum type; + uint8_t type; uint16_t ignore; uint16_t num; uint16_t copy; diff --git a/src/renderer_mtl.mm b/src/renderer_mtl.mm index be6dfc63fd..fc98573a2b 100644 --- a/src/renderer_mtl.mm +++ b/src/renderer_mtl.mm @@ -1751,7 +1751,7 @@ void commit(UniformBuffer& _uniformBuffer) break; } - UniformType::Enum type; + uint8_t type; uint16_t loc; uint16_t num; uint16_t copy; @@ -1769,7 +1769,7 @@ void commit(UniformBuffer& _uniformBuffer) data = (const char*)m_uniforms[handle.idx]; } - switch ( (uint32_t)type) + switch (type) { case UniformType::Mat3: case UniformType::Mat3|kUniformFragmentBit: @@ -2229,7 +2229,7 @@ void processArguments( } UniformType::Enum type = convertMtlType(dataType); - constantBuffer->writeUniformHandle( (UniformType::Enum)(type|fragmentBit), uint32_t(uniform.offset), info->m_handle, uint16_t(num) ); + constantBuffer->writeUniformHandle(type|fragmentBit, uint32_t(uniform.offset), info->m_handle, uint16_t(num) ); BX_TRACE("store %s %d offset:%d", name, info->m_handle, uint32_t(uniform.offset) ); } } diff --git a/src/renderer_vk.cpp b/src/renderer_vk.cpp index 59d4a11f95..6a3167b7c6 100644 --- a/src/renderer_vk.cpp +++ b/src/renderer_vk.cpp @@ -4150,7 +4150,7 @@ VK_IMPORT_DEVICE break; } - UniformType::Enum type; + uint8_t type; uint16_t loc; uint16_t num; uint16_t copy; @@ -4168,7 +4168,7 @@ VK_IMPORT_DEVICE data = (const char*)m_uniforms[handle.idx]; } - switch ( (uint32_t)type) + switch (type) { case UniformType::Mat3: case UniformType::Mat3|kUniformFragmentBit: @@ -5090,7 +5090,7 @@ VK_DESTROY } kind = "user"; - m_constantBuffer->writeUniformHandle( (UniformType::Enum)(type|fragmentBit), regIndex, info->m_handle, regCount); + m_constantBuffer->writeUniformHandle(type|fragmentBit, regIndex, info->m_handle, regCount); } } }