summaryrefslogtreecommitdiff
path: root/src/mesa/swrast/s_masking.c
diff options
context:
space:
mode:
authorBrian Paul <brian.paul@tungstengraphics.com>2005-09-16 21:15:27 +0000
committerBrian Paul <brian.paul@tungstengraphics.com>2005-09-16 21:15:27 +0000
commit67074332728acba86da7630353673b458713bb8a (patch)
treeee17b8b91b16ef04df684157d2b25983373268e7 /src/mesa/swrast/s_masking.c
parent82e314252f0b706c3ae1c748e9d64d8fa58812db (diff)
Fix potential segfault when trying to read pixels outside renderbuffer bounds.
Use _swrast_get_values() which does clipping.
Diffstat (limited to 'src/mesa/swrast/s_masking.c')
-rw-r--r--src/mesa/swrast/s_masking.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/src/mesa/swrast/s_masking.c b/src/mesa/swrast/s_masking.c
index 391dfde7a1..65c4e7d01c 100644
--- a/src/mesa/swrast/s_masking.c
+++ b/src/mesa/swrast/s_masking.c
@@ -61,7 +61,8 @@ _swrast_mask_rgba_span(GLcontext *ctx, struct gl_renderbuffer *rb,
ASSERT(span->arrayMask & SPAN_RGBA);
if (span->arrayMask & SPAN_XY) {
- rb->GetValues(ctx, rb, n, span->array->x, span->array->y, dest);
+ _swrast_get_values(ctx, rb, n, span->array->x, span->array->y,
+ dest, 4 * sizeof(GLchan));
}
else {
_swrast_read_rgba_span(ctx, rb, n, span->x, span->y, dest);
@@ -134,11 +135,12 @@ _swrast_mask_ci_span(GLcontext *ctx, struct gl_renderbuffer *rb,
GLuint i;
ASSERT(span->arrayMask & SPAN_INDEX);
- ASSERT(span->end < MAX_WIDTH);
+ ASSERT(span->end <= MAX_WIDTH);
ASSERT(rb->DataType == GL_UNSIGNED_INT);
if (span->arrayMask & SPAN_XY) {
- rb->GetValues(ctx, rb, span->end, span->array->x, span->array->y, dest);
+ _swrast_get_values(ctx, rb, span->end, span->array->x, span->array->y,
+ dest, sizeof(GLuint));
}
else {
_swrast_read_index_span(ctx, rb, span->end, span->x, span->y, dest);