r300: fix overflow in r300_draw_elements_immediate

Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/36447>
This commit is contained in:
Pavel Ondračka 2025-12-03 19:07:59 +01:00 committed by Marge Bot
parent bf453aa004
commit 31aea50093

View file

@ -544,7 +544,14 @@ static void r300_draw_elements_immediate(struct r300_context *r300,
if (draw->count & 1)
OUT_CS(ptr2[i] + draw->index_bias);
} else {
OUT_CS_TABLE(ptr2, count_dwords);
/* OUT_CS_TABLE expects full dwords so pack the odd tail manually. */
if (draw->count & 1) {
if (count_dwords > 1)
OUT_CS_TABLE(ptr2, count_dwords - 1);
OUT_CS(ptr2[draw->count - 1]);
} else {
OUT_CS_TABLE(ptr2, count_dwords);
}
}
break;