[Mesa-dev] [PATCH] mesa: fix NULL pointer deref bug in _mesa_drawbuffers()

[Brian Paul]

This is a follow-on fix to commit 39b40ad144.  Fixes a crash if the
user calls glDrawBuffers(0, NULL).

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=82814
Cc: "10.2" <mesa-stable at lists.freedesktop.org>
---
 src/mesa/main/buffers.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/mesa/main/buffers.c b/src/mesa/main/buffers.c
index 140cf6e..8a0852c 100644
--- a/src/mesa/main/buffers.c
+++ b/src/mesa/main/buffers.c
@@ -498,7 +498,7 @@ _mesa_drawbuffers(struct gl_context *ctx, GLuint n, const GLenum *buffers,
     * (ex: glDrawBuffer(GL_FRONT_AND_BACK)).
     * Otherwise, destMask[x] can only have one bit set.
     */
-   if (_mesa_bitcount(destMask[0]) > 1) {
+   if (n > 0 && _mesa_bitcount(destMask[0]) > 1) {
       GLuint count = 0, destMask0 = destMask[0];
       while (destMask0) {
          GLint bufIndex = ffs(destMask0) - 1;
-- 
1.7.10.4