summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBrian Paul <brianp@vmware.com>2009-02-11 08:46:21 -0700
committerBrian Paul <brianp@vmware.com>2009-02-11 09:17:21 -0700
commit2c1ea0720deb9b1f90fc294a7a731270d4f4bad6 (patch)
tree7bc3e681dae1632abf716f91b28f2240dffd83cf
parent369d1859d7bc4a6213f128718f8affc8e4f06006 (diff)
glsl: fix glUniform() array bounds error checking
If too many array elements are specified, they're to be silently ignored (don't raise a GL error). Fixes another issue in bug 20056.
-rw-r--r--src/mesa/shader/shader_api.c30
1 files changed, 21 insertions, 9 deletions
diff --git a/src/mesa/shader/shader_api.c b/src/mesa/shader/shader_api.c
index 44c28c4422..8b9281a086 100644
--- a/src/mesa/shader/shader_api.c
+++ b/src/mesa/shader/shader_api.c
@@ -1616,19 +1616,31 @@ set_program_uniform(GLcontext *ctx, struct gl_program *program,
else {
/* ordinary uniform variable */
GLsizei k, i;
- GLint slots = (param->Size + 3) / 4;
+ const GLint slots = (param->Size + 3) / 4;
+ const GLint typeSize = sizeof_glsl_type(param->DataType);
- if (count * elems > (GLint) param->Size) {
- _mesa_error(ctx, GL_INVALID_OPERATION, "glUniform(count too large)");
- return;
+ if (param->Size > typeSize) {
+ /* an array */
+ /* we'll ignore extra data below */
+ }
+ else {
+ /* non-array: count must be one */
+ if (count != 1) {
+ _mesa_error(ctx, GL_INVALID_OPERATION,
+ "glUniform(uniform is not an array)");
+ return;
+ }
}
-
- if (count > slots)
- count = slots;
for (k = 0; k < count; k++) {
- GLfloat *uniformVal =
- program->Parameters->ParameterValues[index + offset + k];
+ GLfloat *uniformVal;
+
+ if (offset + k > slots) {
+ /* Extra array data is ignored */
+ break;
+ }
+
+ uniformVal = program->Parameters->ParameterValues[index + offset + k];
if (is_integer_type(type)) {
const GLint *iValues = ((const GLint *) values) + k * elems;
for (i = 0; i < elems; i++) {