Allocate N+1 arrays instead of N to avoid out-of-bounds access when unzipping loops (#2663)

2 files changed, 2 insertions, 2 deletions

diff --git a/source/slang/slang-ir-autodiff-unzip.h b/source/slang/slang-ir-autodiff-unzip.h
index eb8b09417..2d5261b63 100644
--- a/source/slang/slang-ir-autodiff-unzip.h
+++ b/source/slang/slang-ir-autodiff-unzip.h
@@ -588,7 +588,7 @@ struct DiffUnzipPass
                     arrayType,
                     builder.getIntValue(
                         builder.getUIntType(),
-                        region->maxIters));
+                        region->maxIters + 1));
             }
 
             // Reverse the list since the indices needs to be 
diff --git a/tests/autodiff/reverse-loop.slang b/tests/autodiff/reverse-loop.slang
index f6e951eab..828a06185 100644
--- a/tests/autodiff/reverse-loop.slang
+++ b/tests/autodiff/reverse-loop.slang
@@ -13,7 +13,7 @@ float test_simple_loop(float y)
 {
     float t = y;
 
-    [MaxIters(5)]
+    [MaxIters(3)]
     for (int i = 0; i < 3; i++)
     {
         t = t * t;