[Mesa-dev] [PATCH 03/26] mesa/es: Remove redundant texture target validation

[Kenneth Graunke]

On 08/20/2012 10:04 AM, Ian Romanick wrote:
> On 08/20/2012 12:15 AM, Kenneth Graunke wrote:
>> On 08/19/2012 11:28 PM, Kenneth Graunke wrote:
>> Wait, no, there is a bug: it turns out that MultiTexCoord does
>> absolutely /no/ validation on its targets.  From vbo_attrib_tmp.h:
>>
>> static void GLAPIENTRY
>> TAG(MultiTexCoord4f)(GLenum target, GLfloat x, GLfloat y, GLfloat z,
>> GLfloat w)
>> {
>>     GET_CURRENT_CONTEXT(ctx);
>>     GLuint attr = (target & 0x7) + VBO_ATTRIB_TEX0;
>>     ATTR4F(attr, x, y, z, w);
>> }
>>
>> In other words, it happily accepts 0x31337 and calls it GL_TEXTURE7.  I
>> verified this with a small GL program.
> 
> Dare I ask what happens if you pass GL_TEXTURE0+666?  Does it just smash
> context memory?  That seems bad. :(

(GL_TEXTURE0+666) & 0x7 = 2, so it would be the same as GL_TEXTURE2.