[Mesa-dev] [PATCH v1] i915: fixing driver crashes if too few vertices are submitted

[Marius Predut]

Comparison with a signed expression and unsigned value
is converted to unsigned value, reason for minus value is interpreted
as a big unsigned value. For this case the "for" loop
is going into unexpected behavior.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=38109
Signed-off-by: Marius Predut <marius.predut at intel.com>
---
 src/mesa/tnl_dd/t_dd_dmatmp.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/mesa/tnl_dd/t_dd_dmatmp.h b/src/mesa/tnl_dd/t_dd_dmatmp.h
index 7be3954..88ecc78 100644
--- a/src/mesa/tnl_dd/t_dd_dmatmp.h
+++ b/src/mesa/tnl_dd/t_dd_dmatmp.h
@@ -627,6 +627,8 @@ static void TAG(render_quads_verts)( struct gl_context *ctx,
       LOCAL_VARS;
       GLuint j;
 
+      if(count%4 != 0) return;
+
       INIT(GL_TRIANGLES);
 
       for (j = start; j < count-3; j += 4) {
@@ -1248,7 +1250,7 @@ static GLboolean TAG(validate_render)( struct gl_context *ctx,
 	    ok = (GLint) count < GET_SUBSEQUENT_VB_MAX_ELTS();
 	 }
 	 else {
-	    ok = HAVE_TRIANGLES; /* flatshading is ok. */
+	    ok = HAVE_TRIANGLES && (count%4 == 0); /* flatshading is ok. */
 	 }
 	 break;
       default:
-- 
1.9.1