fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-09 06:48:06 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

swrast: Fix unsigned promotion in pointer arithmetic

Browse source 
When rowstride was negatie, unsigned promotion caused a segfault here:

299│    if (rb->Format == MESA_FORMAT_S8) {
300│       const GLuint rowStride = rb->RowStride;
301│       for (i = 0; i < count; i++) {
302│          if (x[i] >= 0 && y[i] >= 0 && x[i] < w && y[i] < h) {
303├>            stencil[i] = *(map + y[i] * rowStride + x[i]);
304│          }
305│       }
306│    }

Fixes segfault in oglconform
separatestencil-neu(NonPolygon.BothFacesBitmapCoreAPI),
though test still fails.

Note: This is a candidate for the stable branches.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=43327
Reviewed-by: Brian Paul <brianp@vmware.com>
Signed-off-by: Chad Versace <chad.versace@linux.intel.com>
This commit is contained in:
Chad Versace 2012-01-18 15:56:58 -08:00
parent b48d4b64e9
commit aed5c8299f
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/mesa/swrast/s_stencil.c
View file

@ -297,7 +297,7 @@ get_s8_values(struct gl_context *ctx, struct gl_renderbuffer *rb,
GLuint i; GLuint i;
if (rb->Format == MESA_FORMAT_S8) { if (rb->Format == MESA_FORMAT_S8) {
const GLuint rowStride = rb->RowStride; const GLint rowStride = rb->RowStride;
for (i = 0; i < count; i++) { for (i = 0; i < count; i++) {
if (x[i] >= 0 && y[i] >= 0 && x[i] < w && y[i] < h) { if (x[i] >= 0 && y[i] >= 0 && x[i] < w && y[i] < h) {
stencil[i] = *(map + y[i] * rowStride + x[i]); stencil[i] = *(map + y[i] * rowStride + x[i]);
@ -305,8 +305,8 @@ get_s8_values(struct gl_context *ctx, struct gl_renderbuffer *rb,
} }
} }
else { else {
const GLuint bpp = _mesa_get_format_bytes(rb->Format); const GLint bpp = _mesa_get_format_bytes(rb->Format);
const GLuint rowStride = rb->RowStride * bpp; const GLint rowStride = rb->RowStride * bpp;
for (i = 0; i < count; i++) { for (i = 0; i < count; i++) {
if (x[i] >= 0 && y[i] >= 0 && x[i] < w && y[i] < h) { if (x[i] >= 0 && y[i] >= 0 && x[i] < w && y[i] < h) {
const GLubyte *src = map + y[i] * rowStride + x[i] * bpp; const GLubyte *src = map + y[i] * rowStride + x[i] * bpp;