Bug 43250

Created attachment 53859 [details] [review]
i915: Fix cubemap buffer overflow

Commit 87f12bb2 change this:
--- a/src/mesa/drivers/dri/i915/i915_tex_layout.c
+++ b/src/mesa/drivers/dri/i915/i915_tex_layout.c
@@ -126,7 +126,7 @@ i915_miptree_layout_cube(struct intel_mipmap_tree * mt)
    mt->total_height = dim * 4;
 
    for (level = mt->first_level; level <= mt->last_level; level++) {
-      intel_miptree_set_level_info(mt, level, 6,
+      intel_miptree_set_level_info(mt, level,
                                   0, 0,
                                   lvlWidth, lvlHeight,
                                   1);

The parameter was dropped in commit d7b33309, which said:
    intel: Kill intel_mipmap_level::nr_images [v4]

    For all texture targets except GL_TEXTURE_CUBE_MAP, the 'nr_images' and
    'depth' fields of intel_mipmap_level were identical.  In the exceptional
    case, nr_images == 6 and depth == 1.
[...]
       - For GL_TEXTURE_CUBE_MAP, depth is 6.

But you now set it to 1 instead of 6 which of course overwrites a buffer.

The same problem is here:
@@ -335,7 +335,7 @@ i945_miptree_layout_cube(struct intel_mipmap_tree * mt)
 
    /* Set all the levels to effectively occupy the whole rectangular region. */
    for (level = mt->first_level; level <= mt->last_level; level++) {
-      intel_miptree_set_level_info(mt, level, 6,
+      intel_miptree_set_level_info(mt, level,
                                   0, 0,
                                   lvlWidth, lvlHeight, 1);
       lvlWidth /= 2;