Mesa (mesa_7_4_branch): vbo: fix incorrect loop limit in bind_array_obj()
Brian Paul
brianp at kemper.freedesktop.org
Fri May 22 13:11:27 UTC 2009
Module: Mesa
Branch: mesa_7_4_branch
Commit: 3aeace292803c84187af1349f0f487d8cceaf48a
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=3aeace292803c84187af1349f0f487d8cceaf48a
Author: Brian Paul <brianp at vmware.com>
Date: Fri May 22 07:10:47 2009 -0600
vbo: fix incorrect loop limit in bind_array_obj()
The generic_array[] is 16 elements in size, but the loop was doing 32
iterations. The out of bounds array write was clobbering the following
inputs[] array but as luck would have it, that didn't matter.
(cherry picked from commit 8da09e6924ca22ba7951d5a7673dfab2a711a997)
---
src/mesa/vbo/vbo_exec_array.c | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
diff --git a/src/mesa/vbo/vbo_exec_array.c b/src/mesa/vbo/vbo_exec_array.c
index 82f4db1..660f969 100644
--- a/src/mesa/vbo/vbo_exec_array.c
+++ b/src/mesa/vbo/vbo_exec_array.c
@@ -114,8 +114,11 @@ static void bind_array_obj( GLcontext *ctx )
for (i = 0; i < 8; i++)
exec->array.legacy_array[VERT_ATTRIB_TEX0 + i] = &ctx->Array.ArrayObj->TexCoord[i];
- for (i = 0; i < VERT_ATTRIB_MAX; i++)
+ for (i = 0; i < MAX_VERTEX_ATTRIBS; i++) {
+ assert(i < Elements(ctx->Array.ArrayObj->VertexAttrib));
+ assert(i < Elements(exec->array.generic_array));
exec->array.generic_array[i] = &ctx->Array.ArrayObj->VertexAttrib[i];
+ }
exec->array.array_obj = ctx->Array.ArrayObj->Name;
}
More information about the mesa-commit
mailing list