GSdx: fixing a possible buffer overflow

git-svn-id: http://pcsx2.googlecode.com/svn/trunk@5063 96395faa-99c1-11dd-bbfe-3dabce05a288
This commit is contained in:
gabest11 2012-01-08 21:02:42 +00:00
parent 2eec75c2ae
commit 5b5a9787d9
3 changed files with 22 additions and 16 deletions

View File

@ -345,8 +345,16 @@ void GSRenderer::VSync(int field)
if(fillrate > 0) if(fillrate > 0)
{ {
s += format(" | %.2f mpps", fps * fillrate / (1024 * 1024)); s += format(" | %.2f mpps", fps * fillrate / (1024 * 1024));
}
int sum = 0;
for(int i = 0; i < 16; i++)
{
sum += m_perfmon.CPU(GSPerfMon::WorkerDraw0 + i);
}
s += format(" | %d%% CPU", sum);
}
} }
else else
{ {

View File

@ -808,19 +808,19 @@ bool GSRendererSW::GetScanlineGlobalData(SharedData* data)
{ {
// skip per pixel division if q is constant // skip per pixel division if q is constant
GSVertexSW* RESTRICT v = (GSVertexSW*)m_vertex.buff;// data->vertex; GSVertexSW* RESTRICT v = (GSVertexSW*)m_vertex.buff;
if(m_vt->m_eq.q) if(m_vt->m_eq.q)
{ {
gd.sel.fst = 1; gd.sel.fst = 1;
const GSVector4& t = v[m_index.buff[0]].t; // v[data->index[0]].t; const GSVector4& t = v[m_index.buff[0]].t;
if(t.z != 1.0f) if(t.z != 1.0f)
{ {
GSVector4 w = t.zzzz().rcpnr(); GSVector4 w = t.zzzz().rcpnr();
for(int i = 0, j = m_vertex.next/*data->vertex_count*/; i < j; i++) for(int i = 0, j = m_vertex.next; i < j; i++)
{ {
GSVector4 t = v[i].t; GSVector4 t = v[i].t;
@ -832,7 +832,7 @@ bool GSRendererSW::GetScanlineGlobalData(SharedData* data)
{ {
gd.sel.fst = 1; gd.sel.fst = 1;
for(int i = 0, j = m_vertex.next/*data->vertex_count*/; i < j; i += 2) for(int i = 0, j = m_vertex.next; i < j; i += 2)
{ {
GSVector4 t0 = v[i + 0].t; GSVector4 t0 = v[i + 0].t;
GSVector4 t1 = v[i + 1].t; GSVector4 t1 = v[i + 1].t;
@ -853,9 +853,9 @@ bool GSRendererSW::GetScanlineGlobalData(SharedData* data)
GSVector4 half(0x8000, 0x8000); GSVector4 half(0x8000, 0x8000);
GSVertexSW* RESTRICT v = (GSVertexSW*)m_vertex.buff;// data->vertex; GSVertexSW* RESTRICT v = (GSVertexSW*)m_vertex.buff;
for(int i = 0, j = m_vertex.next/*data->vertex_count*/; i < j; i++) for(int i = 0, j = m_vertex.next; i < j; i++)
{ {
GSVector4 t = v[i].t; GSVector4 t = v[i].t;

View File

@ -2133,15 +2133,15 @@ void GSState::GrowVertexBuffer()
} }
m_vertex.buff = vertex; m_vertex.buff = vertex;
m_vertex.maxcount = maxcount - 100; // -100 because skipped vertices don't trigger growing the vertex buffer (VertexKick should be as fast as possible) m_vertex.maxcount = maxcount - 3; // -3 to have some space at the end of the buffer before DrawingKick can grow it
m_index.buff = index; m_index.buff = index;
} }
static GSVector4i s_zw_sign = GSVector4i::x80000000().sll<8>();
template<uint32 prim> template<uint32 prim>
__forceinline void GSState::VertexKick(uint32 skip) __forceinline void GSState::VertexKick(uint32 skip)
{ {
ASSERT(m_vertex.tail < m_vertex.maxcount);
size_t head = m_vertex.head; size_t head = m_vertex.head;
size_t tail = m_vertex.tail; size_t tail = m_vertex.tail;
size_t next = m_vertex.next; size_t next = m_vertex.next;
@ -2260,13 +2260,14 @@ __forceinline void GSState::VertexKick(uint32 skip)
case GS_TRIANGLELIST: case GS_TRIANGLELIST:
case GS_SPRITE: case GS_SPRITE:
case GS_INVALID: case GS_INVALID:
m_vertex.tail = head; m_vertex.tail = head; // no need to check or grow the buffer length
break; break;
case GS_LINESTRIP: case GS_LINESTRIP:
case GS_TRIANGLESTRIP: case GS_TRIANGLESTRIP:
m_vertex.head = head + 1; m_vertex.head = head + 1;
break; // fall through
case GS_TRIANGLEFAN: case GS_TRIANGLEFAN:
if(tail >= m_vertex.maxcount) GrowVertexBuffer(); // in case too many vertices were skipped
break; break;
default: default:
__assume(0); __assume(0);
@ -2275,10 +2276,7 @@ __forceinline void GSState::VertexKick(uint32 skip)
return; return;
} }
if(tail >= m_vertex.maxcount) if(tail >= m_vertex.maxcount) GrowVertexBuffer();
{
GrowVertexBuffer();
}
uint32* RESTRICT buff = &m_index.buff[m_index.tail]; uint32* RESTRICT buff = &m_index.buff[m_index.tail];