[Mesa-dev] [PATCH v3] i915: fixing driver crashes if too few vertices are submitted

[Marius Predut]

Comparison with a signed expression and unsigned value
is converted to unsigned value, reason for minus value is interpreted
as a big unsigned value. For this case the "for" loop
is going into unexpected behavior.

v1: Brian Paul: code style fix.
v2: Ian Romanick: glDrawArrays(GL_QUADS, 0, (n * 4) + k) fail , k < 4.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=38109
Signed-off-by: Marius Predut <marius.predut at intel.com>
---
 src/mesa/tnl_dd/t_dd_dmatmp.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/mesa/tnl_dd/t_dd_dmatmp.h b/src/mesa/tnl_dd/t_dd_dmatmp.h
index 7be3954..f99d977 100644
--- a/src/mesa/tnl_dd/t_dd_dmatmp.h
+++ b/src/mesa/tnl_dd/t_dd_dmatmp.h
@@ -627,6 +627,13 @@ static void TAG(render_quads_verts)( struct gl_context *ctx,
       LOCAL_VARS;
       GLuint j;
 
+      /* Page 18 (page 32 of the PDF) of the OpenGL 2.1 spec says:
+       * The total number of vertices between Begin and End is 4n + k,
+       * where 0 ≤ k ≤ 3; if k is not zero, the final k vertices are  ignored.
+       */
+      count = (count / 4) * 4;
+      if(count == 0) return;
+
       INIT(GL_TRIANGLES);
 
       for (j = start; j < count-3; j += 4) {
-- 
1.9.1