fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-05 11:48:06 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

vbo: check array indexes to prevent negative indexing

Browse source 
See the piglit dlist-fdo31590.c test

NOTE: This is a candidate for the 7.10 branch.
This commit is contained in:
Brian Paul 2011-06-08 08:05:41 -06:00
parent a25271fcb8
commit f1cdce95f6
2 changed files with 13 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/mesa/vbo/vbo_exec_api.c
View file

@ -608,11 +608,15 @@ static void GLAPIENTRY vbo_exec_End( void )
if (ctx->Driver.CurrentExecPrimitive != PRIM_OUTSIDE_BEGIN_END) {
struct vbo_exec_context *exec = &vbo_context(ctx)->exec;
int idx = exec->vtx.vert_count;
int i = exec->vtx.prim_count - 1;
exec->vtx.prim[i].end = 1;
exec->vtx.prim[i].count = idx - exec->vtx.prim[i].start;
if (exec->vtx.prim_count > 0) {
/* close off current primitive */
int idx = exec->vtx.vert_count;
int i = exec->vtx.prim_count - 1;
exec->vtx.prim[i].end = 1;
exec->vtx.prim[i].count = idx - exec->vtx.prim[i].start;
}
ctx->Driver.CurrentExecPrimitive = PRIM_OUTSIDE_BEGIN_END;

11
src/mesa/vbo/vbo_save_api.c
View file

@ -686,12 +686,11 @@ static void DO_FALLBACK( struct gl_context *ctx )
struct vbo_save_context *save = &vbo_context(ctx)->save;
if (save->vert_count || save->prim_count) {
GLint i = save->prim_count - 1;
/* Close off in-progress primitive.
*/
save->prim[i].count = (save->vert_count -
save->prim[i].start);
if (save->prim_count > 0) {
/* Close off in-progress primitive. */
GLint i = save->prim_count - 1;
save->prim[i].count = save->vert_count - save->prim[i].start;
}
/* Need to replay this display list with loopback,
* unfortunately, otherwise this primitive won't be handled