From 187014337d8697a7a8a69f2b03ba2a6b12cb569b Mon Sep 17 00:00:00 2001 From: Garrett Smith Date: Tue, 16 Dec 2025 15:28:26 -0800 Subject: [PATCH 1/3] use alignUp() when resizing data to match RenderPushConstantRange::size, otherwise setVertexBytes() / setFragmentBytes() read beyond end of buffer --- plume_metal.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/plume_metal.cpp b/plume_metal.cpp index 8bbb865..615e9bf 100644 --- a/plume_metal.cpp +++ b/plume_metal.cpp @@ -2552,7 +2552,7 @@ namespace plume { assert(range.binding < MAX_PUSH_CONSTANT_BINDINGS && "Push constants out of range"); pushConstants.resize(activeComputePipelineLayout->pushConstantRanges.size()); - pushConstants[rangeIndex].data.resize(range.size); + pushConstants[rangeIndex].data.resize(alignUp(range.size)); memcpy(pushConstants[rangeIndex].data.data() + offset, data, size == 0 ? range.size : size); pushConstants[rangeIndex].binding = range.binding; pushConstants[rangeIndex].set = range.set; @@ -2606,7 +2606,7 @@ namespace plume { assert(range.binding < MAX_PUSH_CONSTANT_BINDINGS && "Push constants out of range"); pushConstants.resize(activeGraphicsPipelineLayout->pushConstantRanges.size()); - pushConstants[rangeIndex].data.resize(range.size); + pushConstants[rangeIndex].data.resize(alignUp(range.size)); memcpy(pushConstants[rangeIndex].data.data() + offset, data, size == 0 ? range.size : size); pushConstants[rangeIndex].binding = range.binding; pushConstants[rangeIndex].set = range.set; From 791773acfc9d9685cb2eddadeed34a2208c83b76 Mon Sep 17 00:00:00 2001 From: Garrett Smith Date: Tue, 16 Dec 2025 15:32:03 -0800 Subject: [PATCH 2/3] casting MetalDrawable to MetalTexture is not safe, so cast to their common parent class (ExtendedRenderTexture) and move barrierStages up to ExtendedRenderTexture --- plume_metal.cpp | 3 ++- plume_metal.h | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/plume_metal.cpp b/plume_metal.cpp index 615e9bf..321ea3b 100644 --- a/plume_metal.cpp +++ b/plume_metal.cpp @@ -2030,6 +2030,7 @@ namespace plume { } RenderTexture *MetalSwapChain::getTexture(const uint32_t textureIndex) { + assert(textureIndex < drawables.size()); return &drawables[textureIndex]; } @@ -2400,7 +2401,7 @@ namespace plume { for (int i = 0; i < textureBarriersCount; i++) { const RenderTextureBarrier &textureBarrier = textureBarriers[i]; - MetalTexture *interfaceTexture = static_cast(textureBarrier.texture); + ExtendedRenderTexture *interfaceTexture = static_cast(textureBarrier.texture); srcStageMask |= toStageMask(interfaceTexture->barrierStages); interfaceTexture->barrierStages = stages; diff --git a/plume_metal.h b/plume_metal.h index 61a721d..cf55279 100644 --- a/plume_metal.h +++ b/plume_metal.h @@ -201,6 +201,7 @@ namespace plume { struct ExtendedRenderTexture : RenderTexture { RenderTextureDesc desc; + RenderBarrierStages barrierStages = RenderBarrierStage::NONE; virtual MTL::Texture* getTexture() const = 0; }; @@ -596,7 +597,6 @@ namespace plume { RenderTextureLayout layout = RenderTextureLayout::UNKNOWN; MetalPool *pool = nullptr; MTL::Drawable *drawable = nullptr; - RenderBarrierStages barrierStages = RenderBarrierStage::NONE; MetalTexture() = default; MetalTexture(const MetalDevice *device, MetalPool *pool, const RenderTextureDesc &desc); From 484bafd2a1c4f7d4f13c033b7f372e463485562a Mon Sep 17 00:00:00 2001 From: Garrett Smith Date: Wed, 17 Dec 2025 10:28:41 -0800 Subject: [PATCH 3/3] Update plume_metal.cpp Co-authored-by: dcvz --- plume_metal.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plume_metal.cpp b/plume_metal.cpp index 321ea3b..44d8b84 100644 --- a/plume_metal.cpp +++ b/plume_metal.cpp @@ -2401,7 +2401,7 @@ namespace plume { for (int i = 0; i < textureBarriersCount; i++) { const RenderTextureBarrier &textureBarrier = textureBarriers[i]; - ExtendedRenderTexture *interfaceTexture = static_cast(textureBarrier.texture); + ExtendedRenderTexture *interfaceTexture = static_cast(textureBarrier.texture); srcStageMask |= toStageMask(interfaceTexture->barrierStages); interfaceTexture->barrierStages = stages;