Mesa (staging/21.3): mesa: fix buffer overrun in SavedObj texture obj array
GitLab Mirror
gitlab-mirror at kemper.freedesktop.org
Mon Nov 15 21:11:00 UTC 2021
Module: Mesa
Branch: staging/21.3
Commit: b7b6bbb0640fe91211619241c6a164c9a263115d
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=b7b6bbb0640fe91211619241c6a164c9a263115d
Author: Timothy Arceri <tarceri at itsqueeze.com>
Date: Fri Nov 12 19:31:24 2021 +1100
mesa: fix buffer overrun in SavedObj texture obj array
Fixes: 3be42f9ca19d ("mesa: rewrite glPushAttrib/glPopAttrib to get rid of malloc")
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/5621
Reviewed-by: Ilia Mirkin <imirkin at alum.mit.edu>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/13773>
(cherry picked from commit 9d9de15a020d317d4486124f97b2cf06b98ee8b6)
---
.pick_status.json | 2 +-
src/mesa/main/mtypes.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/.pick_status.json b/.pick_status.json
index 53279617d20..1d81e580314 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -220,7 +220,7 @@
"description": "mesa: fix buffer overrun in SavedObj texture obj array",
"nominated": true,
"nomination_type": 1,
- "resolution": 0,
+ "resolution": 1,
"main_sha": null,
"because_sha": "3be42f9ca19d593d374d309f47ebd80abb001a24"
},
diff --git a/src/mesa/main/mtypes.h b/src/mesa/main/mtypes.h
index ca349f4bb47..80715358947 100644
--- a/src/mesa/main/mtypes.h
+++ b/src/mesa/main/mtypes.h
@@ -5123,7 +5123,7 @@ struct gl_texture_attrib_node
/* For saving per texture object state (wrap modes, filters, etc),
* SavedObj[][].Target is unused, so the value is invalid.
*/
- struct gl_texture_object SavedObj[MAX_TEXTURE_UNITS][NUM_TEXTURE_TARGETS];
+ struct gl_texture_object SavedObj[MAX_COMBINED_TEXTURE_IMAGE_UNITS][NUM_TEXTURE_TARGETS];
};
More information about the mesa-commit
mailing list