[Mesa-stable] [Mesa-dev] [PATCH] mesa: fix NULL pointer deref bug in _mesa_drawbuffers()

[Roland Scheidegger]

Am 19.08.2014 15:53, schrieb Brian Paul:
> This is a follow-on fix to commit 39b40ad144.  Fixes a crash if the
> user calls glDrawBuffers(0, NULL).
> 
> Bugzilla: https://urldefense.proofpoint.com/v1/url?u=https://bugs.freedesktop.org/show_bug.cgi?id%3D82814&k=oIvRg1%2BdGAgOoM1BIlLLqw%3D%3D%0A&r=F4msKE2WxRzA%2BwN%2B25muztFm5TSPwE8HKJfWfR2NgfY%3D%0A&m=ynH9vTD3QVde873TpUm4VrqP7bv1FGR6jkT0KOeHTvs%3D%0A&s=4401726373238b8e1eed0469d9df7a8242cc58b23ce6f3ca8d4b51368bdf3d52
> Cc: "10.2" <mesa-stable at lists.freedesktop.org>
> ---
>  src/mesa/main/buffers.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/mesa/main/buffers.c b/src/mesa/main/buffers.c
> index 140cf6e..8a0852c 100644
> --- a/src/mesa/main/buffers.c
> +++ b/src/mesa/main/buffers.c
> @@ -498,7 +498,7 @@ _mesa_drawbuffers(struct gl_context *ctx, GLuint n, const GLenum *buffers,
>      * (ex: glDrawBuffer(GL_FRONT_AND_BACK)).
>      * Otherwise, destMask[x] can only have one bit set.
>      */
> -   if (_mesa_bitcount(destMask[0]) > 1) {
> +   if (n > 0 && _mesa_bitcount(destMask[0]) > 1) {
>        GLuint count = 0, destMask0 = destMask[0];
>        while (destMask0) {
>           GLint bufIndex = ffs(destMask0) - 1;
> 

Reviewed-by: Roland Scheidegger <sroland at vmware.com>