Mesa (master): st/mesa: fix glCopyTexSubImage crash

[Brian Paul]

Module: Mesa
Branch: master
Commit: 9b04abe36812a34ba447e5b1f8d8e44a10510820
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=9b04abe36812a34ba447e5b1f8d8e44a10510820

Author: Brian Paul <brianp at vmware.com>
Date:   Fri Aug 10 09:12:50 2012 -0600

st/mesa: fix glCopyTexSubImage crash

Fixes a WebGL crash.  The dest texture image is at level 2 and is of
size 1x1 texel.  The st texture image is a stand-alone resource, not
a pointer into a complete mipmap.  So the resource has one level and
trying to write to level 2 blows up.

Fixes http://bugs.freedesktop.org/show_bug.cgi?id=53314
and http://bugs.freedesktop.org/show_bug.cgi?id=53319

Note: This is a candidate for the 8.0 branch.

Reviewed-by: Jose Fonseca <jfonseca at vmware.com>

---

 src/mesa/state_tracker/st_cb_texture.c |   10 +++++++++-
 1 files changed, 9 insertions(+), 1 deletions(-)

diff --git a/src/mesa/state_tracker/st_cb_texture.c b/src/mesa/state_tracker/st_cb_texture.c
index a7f57b9..92ce3fa 100644
--- a/src/mesa/state_tracker/st_cb_texture.c
+++ b/src/mesa/state_tracker/st_cb_texture.c
@@ -1004,14 +1004,22 @@ st_CopyTexSubImage(struct gl_context *ctx, GLuint dims,
        !do_flip) {
       /* use surface_copy() / blit */
       struct pipe_box src_box;
+      unsigned dstLevel;
+
       u_box_2d_zslice(srcX, srcY, strb->surface->u.tex.first_layer,
                       width, height, &src_box);
 
+      /* If stImage->pt is an independent image (not a pointer into a full
+       * mipmap) stImage->pt.last_level will be zero and we need to use that
+       * as the dest level.
+       */
+      dstLevel = MIN2(stImage->base.Level, stImage->pt->last_level);
+
       /* for resource_copy_region(), y=0=top, always */
       pipe->resource_copy_region(pipe,
                                  /* dest */
                                  stImage->pt,
-                                 stImage->base.Level,
+                                 dstLevel,
                                  destX, destY, destZ + stImage->base.Face,
                                  /* src */
                                  strb->texture,