Mesa (master): glsl: fix glUniform() array bounds error checking

[Brian Paul]

Module: Mesa
Branch: master
Commit: 2c1ea0720deb9b1f90fc294a7a731270d4f4bad6
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=2c1ea0720deb9b1f90fc294a7a731270d4f4bad6

Author: Brian Paul <brianp at vmware.com>
Date:   Wed Feb 11 08:46:21 2009 -0700

glsl: fix glUniform() array bounds error checking

If too many array elements are specified, they're to be silently ignored (don't
raise a GL error).

Fixes another issue in bug 20056.

---

 src/mesa/shader/shader_api.c |   30 +++++++++++++++++++++---------
 1 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/src/mesa/shader/shader_api.c b/src/mesa/shader/shader_api.c
index 44c28c4..8b9281a 100644
--- a/src/mesa/shader/shader_api.c
+++ b/src/mesa/shader/shader_api.c
@@ -1616,19 +1616,31 @@ set_program_uniform(GLcontext *ctx, struct gl_program *program,
    else {
       /* ordinary uniform variable */
       GLsizei k, i;
-      GLint slots = (param->Size + 3) / 4;
+      const GLint slots = (param->Size + 3) / 4;
+      const GLint typeSize = sizeof_glsl_type(param->DataType);
 
-      if (count * elems > (GLint) param->Size) {
-         _mesa_error(ctx, GL_INVALID_OPERATION, "glUniform(count too large)");
-         return;
+      if (param->Size > typeSize) {
+         /* an array */
+         /* we'll ignore extra data below */
+      }
+      else {
+         /* non-array: count must be one */
+         if (count != 1) {
+            _mesa_error(ctx, GL_INVALID_OPERATION,
+                        "glUniform(uniform is not an array)");
+            return;
+         }
       }
-
-      if (count > slots)
-         count = slots;
 
       for (k = 0; k < count; k++) {
-         GLfloat *uniformVal =
-            program->Parameters->ParameterValues[index + offset + k];
+         GLfloat *uniformVal;
+
+         if (offset + k > slots) {
+            /* Extra array data is ignored */
+            break;
+         }
+
+         uniformVal = program->Parameters->ParameterValues[index + offset + k];
          if (is_integer_type(type)) {
             const GLint *iValues = ((const GLint *) values) + k * elems;
             for (i = 0; i < elems; i++) {