diff options
| author | Brian Paul <brianp@vmware.com> | 2009-11-04 17:51:21 -0700 |
|---|---|---|
| committer | Brian Paul <brianp@vmware.com> | 2009-11-04 17:51:28 -0700 |
| commit | 1c3f7ab74ce492d6c92f2e3a0f29957fa9a71d96 (patch) | |
| tree | 3250818d475862c3427902dfafbcfbd64bd3cf9e /src/mesa/vbo/vbo_exec.h | |
| parent | bc4ad7c2ae069a7d361f2210d39dbb91777cce76 (diff) | |
vbo: fix out-of-bounds array access
The exec->vtx.inputs[] array was being written past its end. This was
clobbering the following vbo_exec_context::eval state. Probably not noticed
since evaluators and immediate mode rendering don't happen at the same time.
Fixed the loop in vbo_exec_vtx_init().
Changed the size of the vbo_exec_context::vtx.arrays[] array.
Added a bunch of debug-build assertions.
Issue found by Vinson Lee.
Diffstat (limited to 'src/mesa/vbo/vbo_exec.h')
| -rw-r--r-- | src/mesa/vbo/vbo_exec.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/mesa/vbo/vbo_exec.h b/src/mesa/vbo/vbo_exec.h index e0f44892cf..7fb5926160 100644 --- a/src/mesa/vbo/vbo_exec.h +++ b/src/mesa/vbo/vbo_exec.h @@ -103,7 +103,7 @@ struct vbo_exec_context GLubyte active_sz[VBO_ATTRIB_MAX]; GLfloat *attrptr[VBO_ATTRIB_MAX]; - struct gl_client_array arrays[VBO_ATTRIB_MAX]; + struct gl_client_array arrays[VERT_ATTRIB_MAX]; /* According to program mode, the values above plus current * values are squashed down to the 32 attributes passed to the |