Mesa (master): st/mesa: use signed temporary variable to store _ColorDrawBufferIndexes
Emil Velikov
evelikov at kemper.freedesktop.org
Wed Jan 15 14:32:00 UTC 2014
Module: Mesa
Branch: master
Commit: bfcf78c1101a1cbcdd9a479722203047c8d6c26a
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=bfcf78c1101a1cbcdd9a479722203047c8d6c26a
Author: Emil Velikov <emil.l.velikov at gmail.com>
Date: Wed Jan 15 11:39:24 2014 +0000
st/mesa: use signed temporary variable to store _ColorDrawBufferIndexes
The temporary variable used to store _ColorDrawBufferIndexes must be
signed (GLint), otherwise the following conditional will be incorrectly
evaluated. Leading to crashes in the driver/mesa or accessing/writing
to arbitrary memory location. The bug dates back to 2009.
Cc: 10.0 9.2 9.1 <mesa-stable at lists.freedesktop.org>
Reviewed-by: Marek Olšák <marek.olsak at amd.com>
Signed-off-by: Emil Velikov <emil.l.velikov at gmail.com>
---
src/mesa/state_tracker/st_cb_clear.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/mesa/state_tracker/st_cb_clear.c b/src/mesa/state_tracker/st_cb_clear.c
index 87dccee..79124b3 100644
--- a/src/mesa/state_tracker/st_cb_clear.c
+++ b/src/mesa/state_tracker/st_cb_clear.c
@@ -444,7 +444,7 @@ st_Clear(struct gl_context *ctx, GLbitfield mask)
if (mask & BUFFER_BITS_COLOR) {
for (i = 0; i < ctx->DrawBuffer->_NumColorDrawBuffers; i++) {
- GLuint b = ctx->DrawBuffer->_ColorDrawBufferIndexes[i];
+ GLint b = ctx->DrawBuffer->_ColorDrawBufferIndexes[i];
if (b >= 0 && mask & (1 << b)) {
struct gl_renderbuffer *rb
More information about the mesa-commit
mailing list