diff options
| author | Stefan Werner <stefan.werner@tangent-animation.com> | 2020-03-08 23:31:47 +0300 |
|---|---|---|
| committer | Stefan Werner <stefan.werner@tangent-animation.com> | 2020-03-08 23:31:47 +0300 |
| commit | bc6bbe5fac864ded3a00f4a50d5eb79f89b74c75 (patch) | |
| tree | 28b6819f8ce6eae5a3d515a97ce0dece80e86a64 | |
| parent | 668b64380a7ef5c5079f436dc145a625af56b402 (diff) | |
Fix T74537: Fixed out of bounds memory access in Cycles' PMJ sampler.
| -rw-r--r-- | intern/cycles/kernel/kernel_jitter.h | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/intern/cycles/kernel/kernel_jitter.h b/intern/cycles/kernel/kernel_jitter.h index b733bb9fee2..5b6e3bbf501 100644 --- a/intern/cycles/kernel/kernel_jitter.h +++ b/intern/cycles/kernel/kernel_jitter.h @@ -198,7 +198,7 @@ ccl_device void cmj_sample_2D(int s, int N, int p, float *fx, float *fy) ccl_device float pmj_sample_1D(KernelGlobals *kg, int sample, int rng_hash, int dimension) { /* Fallback to random */ - if (sample > NUM_PMJ_SAMPLES) { + if (sample >= NUM_PMJ_SAMPLES) { int p = rng_hash + dimension; return cmj_randfloat(sample, p); } @@ -211,10 +211,11 @@ ccl_device float pmj_sample_1D(KernelGlobals *kg, int sample, int rng_hash, int ccl_device void pmj_sample_2D( KernelGlobals *kg, int sample, int rng_hash, int dimension, float *fx, float *fy) { - if (sample > NUM_PMJ_SAMPLES) { + if (sample >= NUM_PMJ_SAMPLES) { int p = rng_hash + dimension; *fx = cmj_randfloat(sample, p); *fy = cmj_randfloat(sample, p + 1); + return; } uint tmp_rng = cmj_hash_simple(dimension, rng_hash); int index = ((dimension % NUM_PMJ_PATTERNS) * NUM_PMJ_SAMPLES + sample) * 2; |