1 files changed, 44 insertions, 5 deletions

diff --git a/src/mesa/main/bufferobj.c b/src/mesa/main/bufferobj.c
index 6b22881072..ba19e58cdb 100644
--- a/src/mesa/main/bufferobj.c
+++ b/src/mesa/main/bufferobj.c
@@ -39,6 +39,11 @@
 #include "bufferobj.h"
 
 
+/* Debug flags */
+/*#define VBO_DEBUG*/
+/*#define BOUNDS_CHECK*/
+
+
 #ifdef FEATURE_OES_mapbuffer
 #define DEFAULT_ACCESS GL_MAP_WRITE_BIT
 #else
@@ -520,11 +525,15 @@ _mesa_copy_buffer_subdata(GLcontext *ctx,
 void
 _mesa_init_buffer_objects( GLcontext *ctx )
 {
-   ctx->Array.ArrayBufferObj = ctx->Shared->NullBufferObj;
-   ctx->Array.ElementArrayBufferObj = ctx->Shared->NullBufferObj;
-
-   ctx->CopyReadBuffer = ctx->Shared->NullBufferObj;
-   ctx->CopyWriteBuffer = ctx->Shared->NullBufferObj;
+   _mesa_reference_buffer_object(ctx, &ctx->Array.ArrayBufferObj,
+                                 ctx->Shared->NullBufferObj);
+   _mesa_reference_buffer_object(ctx, &ctx->Array.ElementArrayBufferObj,
+                                 ctx->Shared->NullBufferObj);
+
+   _mesa_reference_buffer_object(ctx, &ctx->CopyReadBuffer,
+                                 ctx->Shared->NullBufferObj);
+   _mesa_reference_buffer_object(ctx, &ctx->CopyWriteBuffer,
+                                 ctx->Shared->NullBufferObj);
 }
 
 
@@ -1074,6 +1083,9 @@ _mesa_BufferDataARB(GLenum target, GLsizeiptrARB size,
                 bufObj->Name, size, data, usage);
 #endif
 
+#ifdef BOUNDS_CHECK
+   size += 100;
+#endif
    /* Give the buffer object to the driver!  <data> may be null! */
    ctx->Driver.BufferData( ctx, target, size, data, usage, bufObj );
 }
@@ -1182,6 +1194,17 @@ _mesa_MapBufferARB(GLenum target, GLenum access)
    }
 #endif
 
+#ifdef BOUNDS_CHECK
+   {
+      GLubyte *buf = (GLubyte *) bufObj->Pointer;
+      GLuint i;
+      /* buffer is 100 bytes larger than requested, fill with magic value */
+      for (i = 0; i < 100; i++) {
+         buf[bufObj->Size - i - 1] = 123;
+      }
+   }
+#endif
+
    return bufObj->Pointer;
 }
 
@@ -1208,6 +1231,22 @@ _mesa_UnmapBufferARB(GLenum target)
       return GL_FALSE;
    }
 
+#ifdef BOUNDS_CHECK
+   if (bufObj->Access != GL_READ_ONLY_ARB) {
+      GLubyte *buf = (GLubyte *) bufObj->Pointer;
+      GLuint i;
+      /* check that last 100 bytes are still = magic value */
+      for (i = 0; i < 100; i++) {
+         GLuint pos = bufObj->Size - i - 1;
+         if (buf[pos] != 123) {
+            _mesa_warning(ctx, "Out of bounds buffer object write detected"
+                          " at position %d (value = %u)\n",
+                          pos, buf[pos]);
+         }
+      }
+   }
+#endif
+
 #ifdef VBO_DEBUG
    if (bufObj->AccessFlags & GL_MAP_WRITE_BIT) {
       GLuint i, unchanged = 0;