Mesa (master): r300g: index buffer range checking

[Marek Olšák]

Module: Mesa
Branch: master
Commit: d84bf6d44dcac8cf8babb6ddce05cbc8f76db24c
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=d84bf6d44dcac8cf8babb6ddce05cbc8f76db24c

Author: Marek Olšák <maraeo at gmail.com>
Date:   Wed Jun 23 00:20:11 2010 +0200

r300g: index buffer range checking

---

 src/gallium/drivers/r300/r300_render.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/src/gallium/drivers/r300/r300_render.c b/src/gallium/drivers/r300/r300_render.c
index 4afd124..0fd05b5 100644
--- a/src/gallium/drivers/r300/r300_render.c
+++ b/src/gallium/drivers/r300/r300_render.c
@@ -508,6 +508,12 @@ static void r300_draw_range_elements(struct pipe_context* pipe,
         return;
     }
 
+    /* Index buffer range checking. */
+    if ((start + count) * indexSize > indexBuffer->width0) {
+        fprintf(stderr, "r300: Invalid index buffer range. Skipping rendering.\n");
+        return;
+    }
+
     /* Set up fallback for incompatible vertex layout if needed. */
     if (r300->incompatible_vb_layout || r300->velems->incompatible_layout) {
         r300_begin_vertex_translate(r300);