diff options
| author | Brian Paul <brianp@vmware.com> | 2009-11-04 17:51:21 -0700 |
|---|---|---|
| committer | Brian Paul <brianp@vmware.com> | 2009-11-04 17:51:28 -0700 |
| commit | 1c3f7ab74ce492d6c92f2e3a0f29957fa9a71d96 (patch) | |
| tree | 3250818d475862c3427902dfafbcfbd64bd3cf9e /src/mesa/math/m_clip_tmp.h | |
| parent | bc4ad7c2ae069a7d361f2210d39dbb91777cce76 (diff) | |
vbo: fix out-of-bounds array access
The exec->vtx.inputs[] array was being written past its end. This was
clobbering the following vbo_exec_context::eval state. Probably not noticed
since evaluators and immediate mode rendering don't happen at the same time.
Fixed the loop in vbo_exec_vtx_init().
Changed the size of the vbo_exec_context::vtx.arrays[] array.
Added a bunch of debug-build assertions.
Issue found by Vinson Lee.
Diffstat (limited to 'src/mesa/math/m_clip_tmp.h')
0 files changed, 0 insertions, 0 deletions