diff options
| author | Adam Jackson <ajax@freedesktop.org> | 2006-04-02 23:51:30 +0000 |
|---|---|---|
| committer | Adam Jackson <ajax@freedesktop.org> | 2006-04-02 23:51:30 +0000 |
| commit | 05ddc4a6c59f4bd288d322594afe4ac561d07fa7 (patch) | |
| tree | 116c45dbed282b1d163a56ca40709e89ac965b5a | |
| parent | b3208c2de9ba2ba5c32af1fc6b11fec9418256ed (diff) | |
Coverity #476: Avoid walking off the end of ->vtx.attrsz, it's declared to
be _TNL_ATTRIB_MAX long so that's not a valid index (woo zero based
indexing).
This code still looks wrong though, the asymmetry between _tnl_copy_to_current
and _tnl_copy_from_current has me worried.
| -rw-r--r-- | src/mesa/tnl/t_vtx_api.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/mesa/tnl/t_vtx_api.c b/src/mesa/tnl/t_vtx_api.c index d52d2f7a47..14a7ab0c0c 100644 --- a/src/mesa/tnl/t_vtx_api.c +++ b/src/mesa/tnl/t_vtx_api.c @@ -194,7 +194,7 @@ static void _tnl_copy_from_current( GLcontext *ctx ) tnl->vtx.CurrentFloatEdgeFlag = (GLfloat)ctx->Current.EdgeFlag; - for (i = _TNL_ATTRIB_POS+1 ; i <= _TNL_ATTRIB_MAX ; i++) + for (i = _TNL_ATTRIB_POS+1 ; i < _TNL_ATTRIB_MAX ; i++) switch (tnl->vtx.attrsz[i]) { case 4: tnl->vtx.attrptr[i][3] = tnl->vtx.current[i][3]; case 3: tnl->vtx.attrptr[i][2] = tnl->vtx.current[i][2]; |