[Mesa-dev] [PATCH 03/11] mesa: add extra null checks in vbo_rebase_prims()

[Juha-Pekka Heikkila]

Signed-off-by: Juha-Pekka Heikkila <juhapekka.heikkila at gmail.com>
Reviewed-by: Matt Turner <mattst88 at gmail.com>
---
 src/mesa/vbo/vbo_rebase.c | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/src/mesa/vbo/vbo_rebase.c b/src/mesa/vbo/vbo_rebase.c
index f3fe5f7..7aa8d08 100644
--- a/src/mesa/vbo/vbo_rebase.c
+++ b/src/mesa/vbo/vbo_rebase.c
@@ -60,10 +60,15 @@ static void *rebase_##TYPE( const void *ptr,			\
 {								\
    const TYPE *in = (TYPE *)ptr;				\
    TYPE *tmp_indices = malloc(count * sizeof(TYPE));	\
-   GLuint i;							\
+   if (tmp_indices != NULL) {                                  \
+      GLuint i;	    					\
 								\
-   for (i = 0; i < count; i++)  				\
-      tmp_indices[i] = in[i] - min_index;			\
+      for (i = 0; i < count; i++)  				\
+         tmp_indices[i] = in[i] - min_index;			\
+   }                                                           \
+   else {                                                      \
+      _mesa_error_no_memory(__FUNCTION__);                     \
+   }                                                           \
 								\
    return (void *)tmp_indices;					\
 }
@@ -148,6 +153,11 @@ void vbo_rebase_prims( struct gl_context *ctx,
        */
       tmp_prims = malloc(sizeof(*prim) * nr_prims);
 
+      if (tmp_prims == NULL) {
+         _mesa_error_no_memory(__FUNCTION__);
+         return;
+      }
+
       for (i = 0; i < nr_prims; i++) {
 	 tmp_prims[i] = prim[i];
 	 tmp_prims[i].basevertex -= min_index;
@@ -186,6 +196,10 @@ void vbo_rebase_prims( struct gl_context *ctx,
       if (map_ib) 
 	 ctx->Driver.UnmapBuffer(ctx, ib->obj, MAP_INTERNAL);
 
+      if (tmp_indices == NULL) {
+         return;
+      }
+
       tmp_ib.obj = ctx->Shared->NullBufferObj;
       tmp_ib.ptr = tmp_indices;
       tmp_ib.count = ib->count;
@@ -198,6 +212,11 @@ void vbo_rebase_prims( struct gl_context *ctx,
        */
       tmp_prims = malloc(sizeof(*prim) * nr_prims);
 
+      if (tmp_prims == NULL) {
+         _mesa_error_no_memory(__FUNCTION__);
+         return;
+      }
+
       for (i = 0; i < nr_prims; i++) {
 	 /* If this fails, it could indicate an application error:
 	  */
-- 
1.8.1.2