From ee6a9e7ed10f775bce312a0b8911ea8721342250 Mon Sep 17 00:00:00 2001
From: Andrey Kleshchev <117672381+akleshchev@users.noreply.github.com>
Date: Tue, 30 Sep 2025 22:44:40 +0300
Subject: #4758 Extra logging to track discard 6

Plus clamped some values and preventing decode from starting
---
 indra/llrender/llimagegl.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'indra/llrender/llimagegl.cpp')

diff --git a/indra/llrender/llimagegl.cpp b/indra/llrender/llimagegl.cpp
index 52738ec626..94115a06fd 100644
--- a/indra/llrender/llimagegl.cpp
+++ b/indra/llrender/llimagegl.cpp
@@ -1544,7 +1544,7 @@ bool LLImageGL::createGLTexture(S32 discard_level, const LLImageRaw* imageraw, S
     if (discard_level < 0)
     {
         llassert(mCurrentDiscardLevel >= 0);
-        discard_level = mCurrentDiscardLevel;
+        discard_level = llmin(mCurrentDiscardLevel, MAX_DISCARD_LEVEL);
     }
 
     // Actual image width/height = raw image width/height * 2^discard_level
@@ -1644,6 +1644,7 @@ bool LLImageGL::createGLTexture(S32 discard_level, const U8* data_in, bool data_
         discard_level = mCurrentDiscardLevel;
     }
     discard_level = llclamp(discard_level, 0, (S32)mMaxDiscardLevel);
+    discard_level = llmin(discard_level, MAX_DISCARD_LEVEL);
 
     if (main_thread // <--- always force creation of new_texname when not on main thread ...
         && !defer_copy // <--- ... or defer copy is set
-- 
cgit v1.2.3


From 45528d33280a2ea8ce03211e8e60d9ef991d07ea Mon Sep 17 00:00:00 2001
From: Andrey Kleshchev <117672381+akleshchev@users.noreply.github.com>
Date: Wed, 1 Oct 2025 20:33:53 +0300
Subject: #4773 Crash on sub_image_lines

Just caught it and discard_level is somehow 7, which seems like it resulted in src going out of bounds, which crashed glTexSubImage2D
---
 indra/llrender/llimagegl.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'indra/llrender/llimagegl.cpp')

diff --git a/indra/llrender/llimagegl.cpp b/indra/llrender/llimagegl.cpp
index 94115a06fd..97ea6f67bd 100644
--- a/indra/llrender/llimagegl.cpp
+++ b/indra/llrender/llimagegl.cpp
@@ -1097,6 +1097,8 @@ void sub_image_lines(U32 target, S32 miplevel, S32 x_offset, S32 y_offset, S32 w
         // full width texture, do 32 lines at a time
         for (U32 y_pos = y_offset; y_pos < y_offset_end; y_pos += batch_size)
         {
+            // If this keeps crashing, pass down data_size, looks like it is using
+            // imageraw->getData(); for data, but goes way over allocated size limit
             glTexSubImage2D(target, miplevel, x_offset, y_pos, width, batch_size, pixformat, pixtype, src);
             src += line_width * batch_size;
         }
@@ -1106,6 +1108,8 @@ void sub_image_lines(U32 target, S32 miplevel, S32 x_offset, S32 y_offset, S32 w
         // partial width or strange height
         for (U32 y_pos = y_offset; y_pos < y_offset_end; y_pos += 1)
         {
+            // If this keeps crashing, pass down data_size, looks like it is using
+            // imageraw->getData(); for data, but goes way over allocated size limit
             glTexSubImage2D(target, miplevel, x_offset, y_pos, width, 1, pixformat, pixtype, src);
             src += line_width;
         }
@@ -1544,8 +1548,9 @@ bool LLImageGL::createGLTexture(S32 discard_level, const LLImageRaw* imageraw, S
     if (discard_level < 0)
     {
         llassert(mCurrentDiscardLevel >= 0);
-        discard_level = llmin(mCurrentDiscardLevel, MAX_DISCARD_LEVEL);
+        discard_level = mCurrentDiscardLevel;
     }
+    discard_level = llmin(discard_level, MAX_DISCARD_LEVEL);
 
     // Actual image width/height = raw image width/height * 2^discard_level
     S32 raw_w = imageraw->getWidth() ;
-- 
cgit v1.2.3