[Mesa-dev] [PATCH] mesa: Fix off-by-one error in Parse_TextureImageId.

[Brian Paul]

On 08/04/2012 01:13 AM, Vinson Lee wrote:
> Fixes out-of-bounds write defect reported by Coverity.
>
> Signed-off-by: Vinson Lee<vlee at freedesktop.org>
> ---
>   src/mesa/program/nvfragparse.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/mesa/program/nvfragparse.c b/src/mesa/program/nvfragparse.c
> index bcc553a..20c8579 100644
> --- a/src/mesa/program/nvfragparse.c
> +++ b/src/mesa/program/nvfragparse.c
> @@ -582,7 +582,7 @@ Parse_TextureImageId(struct parse_state *parseState,
>         RETURN_ERROR1("Expected TEX# source");
>      }
>      unit = atoi((const char *) imageSrc + 3);
> -   if ((unit<  0 || unit>  MAX_TEXTURE_IMAGE_UNITS) ||
> +   if ((unit<  0 || unit>= MAX_TEXTURE_IMAGE_UNITS) ||
>          (unit == 0&&  (imageSrc[3] != '0' || imageSrc[4] != 0))) {
>         RETURN_ERROR1("Invalied TEX# source index");
>      }

Reviewed-by: Brian Paul <brianp at vmware.com>