only allow VERT_ATTRIB_MAX instead of _TNL_ATTRIB_MAX for inputs of vertex programs (fixes a segfault since the result of the shift is undefined otherwise, and it may happen that _TNL_ATTRIB_POINTSIZE will be tried to read, unlike all other attribs this however may be unitialized (might be a bug in itself)).

2 files changed, 2 insertions, 2 deletions

diff --git a/src/mesa/tnl/t_vb_arbprogram.c b/src/mesa/tnl/t_vb_arbprogram.c
index 411a250857..f162b0aa91 100644
--- a/src/mesa/tnl/t_vb_arbprogram.c
+++ b/src/mesa/tnl/t_vb_arbprogram.c
@@ -1253,7 +1253,7 @@ run_arb_vertex_program(GLcontext *ctx, struct tnl_pipeline_stage *stage)
 
    m->nr_inputs = m->nr_outputs = 0;
 
-   for (i = 0; i < _TNL_ATTRIB_MAX; i++) {
+   for (i = 0; i < VERT_ATTRIB_MAX; i++) {
       if (program->Base.InputsRead & (1<<i) ||
 	  (i == VERT_ATTRIB_POS && program->IsPositionInvariant)) {
 	 GLuint j = m->nr_inputs++;
diff --git a/src/mesa/tnl/t_vb_arbprogram.h b/src/mesa/tnl/t_vb_arbprogram.h
index 58efaa4fb9..6de8dca328 100644
--- a/src/mesa/tnl/t_vb_arbprogram.h
+++ b/src/mesa/tnl/t_vb_arbprogram.h
@@ -152,7 +152,7 @@ struct output {
 struct arb_vp_machine {
    GLfloat (*File[4])[4];	/* All values referencable from the program. */
 
-   struct input input[_TNL_ATTRIB_MAX];
+   struct input input[VERT_ATTRIB_MAX];
    GLuint nr_inputs;
 
    struct output output[VERT_RESULT_MAX];