summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--src/mesa/main/bufferobj.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/src/mesa/main/bufferobj.c b/src/mesa/main/bufferobj.c
index a1d4c0190a..03aec367c4 100644
--- a/src/mesa/main/bufferobj.c
+++ b/src/mesa/main/bufferobj.c
@@ -433,6 +433,7 @@ _mesa_validate_pbo_access(GLuint dimensions,
GLenum format, GLenum type, const GLvoid *ptr)
{
GLvoid *start, *end;
+ const GLubyte *sizeAddr; /* buffer size, cast to a pointer */
ASSERT(pack->BufferObj->Name != 0);
@@ -449,11 +450,13 @@ _mesa_validate_pbo_access(GLuint dimensions,
format, type, depth-1, height-1, width);
- if ((const GLubyte *) start > (const GLubyte *)(uintptr_t) pack->BufferObj->Size) {
+ sizeAddr = ((const GLubyte *) 0) + pack->BufferObj->Size;
+
+ if ((const GLubyte *) start > sizeAddr) {
/* This will catch negative values / wrap-around */
return GL_FALSE;
}
- if ((const GLubyte *) end > (const GLubyte *)(uintptr_t) pack->BufferObj->Size) {
+ if ((const GLubyte *) end > sizeAddr) {
/* Image read goes beyond end of buffer */
return GL_FALSE;
}