diff options
author | Sergey Sharybin <sergey.vfx@gmail.com> | 2016-07-11 18:58:42 +0300 |
---|---|---|
committer | Sergey Sharybin <sergey.vfx@gmail.com> | 2016-07-11 18:59:46 +0300 |
commit | ea32a0380148b3261679eded2149ebac7e3a15ef (patch) | |
tree | 5c1c7c34b9db3f37e58d651688302df78e8f79ee /intern/cycles/kernel/bvh/qbvh_volume_all.h | |
parent | 8bc6f8bf20ab13abd232ba12f77eb904dfe95d79 (diff) |
Fix T48824: Crash when having too many ray-to-volume intersections
Code might have writing past the array boundaries.
Diffstat (limited to 'intern/cycles/kernel/bvh/qbvh_volume_all.h')
-rw-r--r-- | intern/cycles/kernel/bvh/qbvh_volume_all.h | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/intern/cycles/kernel/bvh/qbvh_volume_all.h b/intern/cycles/kernel/bvh/qbvh_volume_all.h index 4d3028b37bf..a877e5bb341 100644 --- a/intern/cycles/kernel/bvh/qbvh_volume_all.h +++ b/intern/cycles/kernel/bvh/qbvh_volume_all.h @@ -268,13 +268,11 @@ ccl_device uint BVH_FUNCTION_FULL_NAME(QBVH)(KernelGlobals *kg, /* Intersect ray against primitive. */ hit = triangle_intersect(kg, &isect_precalc, isect_array, P, visibility, object, prim_addr); if(hit) { - /* Move on to next entry in intersections array. */ - isect_array++; + /* Update number of hits now, so we do proper check on max bounces. */ num_hits++; #if BVH_FEATURE(BVH_INSTANCING) num_hits_in_instance++; #endif - isect_array->t = isect_t; if(num_hits == max_hits) { #if BVH_FEATURE(BVH_INSTANCING) # if BVH_FEATURE(BVH_MOTION) @@ -289,6 +287,9 @@ ccl_device uint BVH_FUNCTION_FULL_NAME(QBVH)(KernelGlobals *kg, #endif /* BVH_FEATURE(BVH_INSTANCING) */ return num_hits; } + /* Move on to next entry in intersections array */ + isect_array++; + isect_array->t = isect_t; } } break; @@ -306,13 +307,11 @@ ccl_device uint BVH_FUNCTION_FULL_NAME(QBVH)(KernelGlobals *kg, /* Intersect ray against primitive. */ hit = motion_triangle_intersect(kg, isect_array, P, dir, ray->time, visibility, object, prim_addr); if(hit) { - /* Move on to next entry in intersections array. */ - isect_array++; + /* Update number of hits now, so we do proper check on max bounces. */ num_hits++; # if BVH_FEATURE(BVH_INSTANCING) num_hits_in_instance++; # endif - isect_array->t = isect_t; if(num_hits == max_hits) { # if BVH_FEATURE(BVH_INSTANCING) # if BVH_FEATURE(BVH_MOTION) @@ -327,6 +326,9 @@ ccl_device uint BVH_FUNCTION_FULL_NAME(QBVH)(KernelGlobals *kg, # endif /* BVH_FEATURE(BVH_INSTANCING) */ return num_hits; } + /* Move on to next entry in intersections array */ + isect_array++; + isect_array->t = isect_t; } } break; |