summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorKeith Whitwell <keith@tungstengraphics.com>2005-05-10 18:24:50 +0000
committerKeith Whitwell <keith@tungstengraphics.com>2005-05-10 18:24:50 +0000
commit2fcaf7a529f1e8bbdfbea6c8d9d6703adf5f17ba (patch)
treed1745f441c647d83fb52aeec5dc7f7c150ee24f4 /src
parenta42fe19d8d16e082880900fb5376144696cb7304 (diff)
Ensure programs don't overflow allocated instruction store.
Diffstat (limited to 'src')
-rw-r--r--src/mesa/tnl/t_vp_build.c9
1 files changed, 8 insertions, 1 deletions
diff --git a/src/mesa/tnl/t_vp_build.c b/src/mesa/tnl/t_vp_build.c
index c8caecc79b..678083293b 100644
--- a/src/mesa/tnl/t_vp_build.c
+++ b/src/mesa/tnl/t_vp_build.c
@@ -49,6 +49,8 @@
*/
#define DISASSEM 0
+#define MAX_INSN 200
+
/* Use uregs to represent registers internally, translate to Mesa's
* expected formats on emit.
*
@@ -316,6 +318,11 @@ static void emit_op3fn(struct tnl_program *p,
GLuint nr = p->program->Base.NumInstructions++;
struct vp_instruction *inst = &p->program->Instructions[nr];
+ if (p->program->Base.NumInstructions > MAX_INSN) {
+ _mesa_problem(p->ctx, "Out of instructions in emit_op3fn\n");
+ return;
+ }
+
inst->Opcode = op;
inst->StringPos = 0;
inst->Data = 0;
@@ -1133,7 +1140,7 @@ void _tnl_UpdateFixedFunctionProgram( GLcontext *ctx )
p.temp_flag = 0;
p.temp_reserved = ~((1<<MAX_NV_VERTEX_PROGRAM_TEMPS)-1);
- p.program->Instructions = MALLOC(sizeof(struct vp_instruction) * 100);
+ p.program->Instructions = MALLOC(sizeof(struct vp_instruction) * MAX_INSN);
/* Initialize the arb_program struct */
p.program->Base.String = 0;