Mesa (gallium-mesa-7.4): glsl: fix glUniform() array bounds error checking

[Alan Hourihane]

Module: Mesa
Branch: gallium-mesa-7.4
Commit: 0486d117e4b2022ab9a86c8932e6170aae6b0c3b
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=0486d117e4b2022ab9a86c8932e6170aae6b0c3b

Author: Brian Paul <brianp at vmware.com>
Date:   Wed Feb 11 08:46:21 2009 -0700

glsl: fix glUniform() array bounds error checking

If too many array elements are specified, they're to be silently ignored (don't
raise a GL error).

Fixes another issue in bug 20056.

(cherry picked from master, commit 2c1ea0720deb9b1f90fc294a7a731270d4f4bad6)

---

 src/mesa/shader/shader_api.c |   30 +++++++++++++++++++++---------
 1 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/src/mesa/shader/shader_api.c b/src/mesa/shader/shader_api.c
index e768c39..1c9dd2e 100644
--- a/src/mesa/shader/shader_api.c
+++ b/src/mesa/shader/shader_api.c
@@ -1580,19 +1580,31 @@ set_program_uniform(GLcontext *ctx, struct gl_program *program,
    else {
       /* ordinary uniform variable */
       GLsizei k, i;
-      GLint slots = (param->Size + 3) / 4;
+      const GLint slots = (param->Size + 3) / 4;
+      const GLint typeSize = sizeof_glsl_type(param->DataType);
 
-      if (count * elems > (GLint) param->Size) {
-         _mesa_error(ctx, GL_INVALID_OPERATION, "glUniform(count too large)");
-         return;
+      if (param->Size > typeSize) {
+         /* an array */
+         /* we'll ignore extra data below */
+      }
+      else {
+         /* non-array: count must be one */
+         if (count != 1) {
+            _mesa_error(ctx, GL_INVALID_OPERATION,
+                        "glUniform(uniform is not an array)");
+            return;
+         }
       }
-
-      if (count > slots)
-         count = slots;
 
       for (k = 0; k < count; k++) {
-         GLfloat *uniformVal =
-            program->Parameters->ParameterValues[index + offset + k];
+         GLfloat *uniformVal;
+
+         if (offset + k > slots) {
+            /* Extra array data is ignored */
+            break;
+         }
+
+         uniformVal = program->Parameters->ParameterValues[index + offset + k];
          if (is_integer_type(type)) {
             const GLint *iValues = ((const GLint *) values) + k * elems;
             for (i = 0; i < elems; i++) {