Mesa (master): mesa/st: Prevent 'end' < 'start' in vbo_exec_DrawRangeElementsBaseVertex()
Jose Fonseca
jrfonseca at kemper.freedesktop.org
Thu Apr 7 11:20:29 UTC 2011
Module: Mesa
Branch: master
Commit: 23d75936a72b9a9b9e1d04a901a86a75d93dbffb
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=23d75936a72b9a9b9e1d04a901a86a75d93dbffb
Author: José Fonseca <jfonseca at vmware.com>
Date: Wed Apr 6 15:10:19 2011 +0100
mesa/st: Prevent 'end' < 'start' in vbo_exec_DrawRangeElementsBaseVertex()
We adjust 'end' to fit into _MaxElement, but that may result into a 'start'
value bigger than 'end' being passed downstream, causing havoc.
This could be seen with arb_robustness_draw-vbo-bounds, due to an
application bug.
---
src/mesa/vbo/vbo_exec_array.c | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)
diff --git a/src/mesa/vbo/vbo_exec_array.c b/src/mesa/vbo/vbo_exec_array.c
index 98d6bad..6e26e4e 100644
--- a/src/mesa/vbo/vbo_exec_array.c
+++ b/src/mesa/vbo/vbo_exec_array.c
@@ -943,8 +943,13 @@ vbo_exec_DrawRangeElementsBaseVertex(GLenum mode,
/* Set 'end' to the max possible legal value */
assert(ctx->Array.ArrayObj->_MaxElement >= 1);
end = ctx->Array.ArrayObj->_MaxElement - 1;
+
+ if (end < start) {
+ return;
+ }
}
- else if (0) {
+
+ if (0) {
printf("glDraw[Range]Elements{,BaseVertex}"
"(start %u, end %u, type 0x%x, count %d) ElemBuf %u, "
"base %d\n",
More information about the mesa-commit
mailing list