Mesa (staging/21.2): mesa: fix buffer overrun in SavedObj texture obj array

[GitLab Mirror]

Module: Mesa
Branch: staging/21.2
Commit: 73ee9a5917c8cf85d2170e3a7f953a07e1e3b648
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=73ee9a5917c8cf85d2170e3a7f953a07e1e3b648

Author: Timothy Arceri <tarceri at itsqueeze.com>
Date:   Fri Nov 12 19:31:24 2021 +1100

mesa: fix buffer overrun in SavedObj texture obj array

Fixes: 3be42f9ca19d ("mesa: rewrite glPushAttrib/glPopAttrib to get rid of malloc")

Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/5621

Reviewed-by: Ilia Mirkin <imirkin at alum.mit.edu>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/13773>
(cherry picked from commit 9d9de15a020d317d4486124f97b2cf06b98ee8b6)

---

 .pick_status.json      | 2 +-
 src/mesa/main/mtypes.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.pick_status.json b/.pick_status.json
index 5950ac2d77d..9beb773c3ad 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -3163,7 +3163,7 @@
         "description": "mesa: fix buffer overrun in SavedObj texture obj array",
         "nominated": true,
         "nomination_type": 1,
-        "resolution": 0,
+        "resolution": 1,
         "main_sha": null,
         "because_sha": "3be42f9ca19d593d374d309f47ebd80abb001a24"
     },
diff --git a/src/mesa/main/mtypes.h b/src/mesa/main/mtypes.h
index 00792cda027..cca835c62b7 100644
--- a/src/mesa/main/mtypes.h
+++ b/src/mesa/main/mtypes.h
@@ -5129,7 +5129,7 @@ struct gl_texture_attrib_node
    /* For saving per texture object state (wrap modes, filters, etc),
     * SavedObj[][].Target is unused, so the value is invalid.
     */
-   struct gl_texture_object SavedObj[MAX_TEXTURE_UNITS][NUM_TEXTURE_TARGETS];
+   struct gl_texture_object SavedObj[MAX_COMBINED_TEXTURE_IMAGE_UNITS][NUM_TEXTURE_TARGETS];
 };