[Mesa-dev] [PATCH] mesa: Fix segfault on reading from a missing color read buffer.

[Brian Paul]

On 11/13/2012 03:11 PM, Eric Anholt wrote:
> The diff looks funny, but it's moving the integer vs non-integer check
> below the _mesa_source_buffer_exists() check that ensures
> _ColorReadBuffer is non-null, so we get a GL_INVALID_OPERATION instead
> of a segfault.  This looks like it had regressed in the
> _mesa_error_check_format_and_type() changes, which removed the first of
> the two duplicated checks for the source buffer.  Fixes segfault in the
> new piglit ARB_framebuffer_object/negative-readpixels-no-rb.
>
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=45877
> NOTE: This is a candidate for the stable branches.
> ---
>   src/mesa/main/readpix.c |   22 +++++++++++-----------
>   1 file changed, 11 insertions(+), 11 deletions(-)
>
> diff --git a/src/mesa/main/readpix.c b/src/mesa/main/readpix.c
> index f6680c9..d6d105b 100644
> --- a/src/mesa/main/readpix.c
> +++ b/src/mesa/main/readpix.c
> @@ -743,6 +743,17 @@ _mesa_ReadnPixelsARB( GLint x, GLint y, GLsizei width, GLsizei height,
>         return;
>      }
>
> +   if (_mesa_is_user_fbo(ctx->ReadBuffer)&&
> +       ctx->ReadBuffer->Visual.samples>  0) {
> +      _mesa_error(ctx, GL_INVALID_OPERATION, "glReadPixels(multisample FBO)");
> +      return;
> +   }
> +
> +   if (!_mesa_source_buffer_exists(ctx, format)) {
> +      _mesa_error(ctx, GL_INVALID_OPERATION, "glReadPixels(no readbuffer)");
> +      return;
> +   }
> +
>      /* Check that the destination format and source buffer are both
>       * integer-valued or both non-integer-valued.
>       */
> @@ -757,17 +768,6 @@ _mesa_ReadnPixelsARB( GLint x, GLint y, GLsizei width, GLsizei height,
>         }
>      }
>
> -   if (_mesa_is_user_fbo(ctx->ReadBuffer)&&
> -       ctx->ReadBuffer->Visual.samples>  0) {
> -      _mesa_error(ctx, GL_INVALID_OPERATION, "glReadPixels(multisample FBO)");
> -      return;
> -   }
> -
> -   if (!_mesa_source_buffer_exists(ctx, format)) {
> -      _mesa_error(ctx, GL_INVALID_OPERATION, "glReadPixels(no readbuffer)");
> -      return;
> -   }
> -
>      if (width == 0 || height == 0)
>         return; /* nothing to do */
>

Reviewed-by: Brian Paul <brianp at vmware.com>