Mesa (master): mesa: fix NULL pointer deref bug in _mesa_drawbuffers()
Brian Paul
brianp at kemper.freedesktop.org
Tue Aug 19 15:41:38 UTC 2014
Module: Mesa
Branch: master
Commit: 31ce84a81f7166ded07e9cb41e5dfe212dd8fed1
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=31ce84a81f7166ded07e9cb41e5dfe212dd8fed1
Author: Brian Paul <brianp at vmware.com>
Date: Tue Aug 19 07:51:07 2014 -0600
mesa: fix NULL pointer deref bug in _mesa_drawbuffers()
This is a follow-on fix to commit 39b40ad144. Fixes a crash if the
user calls glDrawBuffers(0, NULL).
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=82814
Cc: "10.2" <mesa-stable at lists.freedesktop.org>
Reviewed-by: Roland Scheidegger <sroland at vmware.com>
---
src/mesa/main/buffers.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/mesa/main/buffers.c b/src/mesa/main/buffers.c
index 140cf6e..8a0852c 100644
--- a/src/mesa/main/buffers.c
+++ b/src/mesa/main/buffers.c
@@ -498,7 +498,7 @@ _mesa_drawbuffers(struct gl_context *ctx, GLuint n, const GLenum *buffers,
* (ex: glDrawBuffer(GL_FRONT_AND_BACK)).
* Otherwise, destMask[x] can only have one bit set.
*/
- if (_mesa_bitcount(destMask[0]) > 1) {
+ if (n > 0 && _mesa_bitcount(destMask[0]) > 1) {
GLuint count = 0, destMask0 = destMask[0];
while (destMask0) {
GLint bufIndex = ffs(destMask0) - 1;
More information about the mesa-commit
mailing list