[Mesa-dev] [Bug 53426] out-of-bounds access src/mesa/main/fbobject:222

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=53426

--- Comment #2 from Brian Paul <brian.e.paul at gmail.com> 2012-08-16 23:06:25 UTC ---
Alternately, can you try this patch, Vinson?

diff --git a/src/mesa/main/fbobject.c b/src/mesa/main/fbobject.c
index 792a92d..03094cc 100644
--- a/src/mesa/main/fbobject.c
+++ b/src/mesa/main/fbobject.c
@@ -215,8 +215,9 @@ _mesa_get_attachment(struct gl_context *ctx, struct
gl_frame
        * hardware is used.
        */
       i = attachment - GL_COLOR_ATTACHMENT0_EXT;
-      if (i >= ctx->Const.MaxColorAttachments
-         || (i > 0 && ctx->API == API_OPENGLES)) {
+      if (i >= ctx->Const.MaxColorAttachments ||
+          BUFFER_COLOR0 + i >= Elements(fb->Attachment) ||
+         (i > 0 && ctx->API == API_OPENGLES)) {
         return NULL;
       }
       return &fb->Attachment[BUFFER_COLOR0 + i];

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.