From 13f96c5401ffe3869f08fecb2baf5bff2438b02e Mon Sep 17 00:00:00 2001 From: Brian Paul Date: Mon, 10 Nov 2008 14:27:42 -0700 Subject: GLX: fix out-of-bounds memory issue in indirect glAreTexturesResident() See bug 18445. When getting array results, __glXReadReply() always reads a multiple of four bytes. This can cause writing to invalid memory when 'n' is not a multiple of four. Special-case the glAreTexturesResident() functions now. To fix the bug, we use a temporary buffer that's a multiple of four bytes in length. NOTE: this commit also reverts part of commit 919ec22ecf72aa163e1b97d8c7381002131ed32c (glx/x11: Added some #ifdef GLX_DIRECT_RENDERING protection) which directly edited the indirect.c file rather than the python generator! I'm not repairing that issue at this time. --- src/mesa/drivers/dri/common/extension_helper.h | 34 +++++++++++++------------- 1 file changed, 17 insertions(+), 17 deletions(-) (limited to 'src/mesa/drivers') diff --git a/src/mesa/drivers/dri/common/extension_helper.h b/src/mesa/drivers/dri/common/extension_helper.h index 3143ea2b10..65e96657b8 100644 --- a/src/mesa/drivers/dri/common/extension_helper.h +++ b/src/mesa/drivers/dri/common/extension_helper.h @@ -26,7 +26,7 @@ */ #include "utils.h" -#include "glapi/dispatch.h" +#include "dispatch.h" #ifndef NULL # define NULL 0 @@ -1077,6 +1077,13 @@ static const char AreTexturesResident_names[] = ""; #endif +#if defined(need_GL_EXT_framebuffer_object) +static const char IsRenderbufferEXT_names[] = + "i\0" /* Parameter signature */ + "glIsRenderbufferEXT\0" + ""; +#endif + #if defined(need_GL_VERSION_2_0) || defined(need_GL_ATI_separate_stencil) static const char StencilOpSeparate_names[] = "iiii\0" /* Parameter signature */ @@ -1756,6 +1763,13 @@ static const char DeleteFencesNV_names[] = ""; #endif +#if defined(need_GL_SGIX_polynomial_ffd) +static const char DeformationMap3dSGIX_names[] = + "iddiiddiiddiip\0" /* Parameter signature */ + "glDeformationMap3dSGIX\0" + ""; +#endif + #if defined(need_GL_VERSION_2_0) static const char IsShader_names[] = "i\0" /* Parameter signature */ @@ -2001,13 +2015,6 @@ static const char WeightfvARB_names[] = ""; #endif -#if defined(need_GL_EXT_framebuffer_object) -static const char IsRenderbufferEXT_names[] = - "i\0" /* Parameter signature */ - "glIsRenderbufferEXT\0" - ""; -#endif - #if defined(need_GL_MESA_window_pos) static const char WindowPos4fMESA_names[] = "ffff\0" /* Parameter signature */ @@ -4523,13 +4530,6 @@ static const char Minmax_names[] = ""; #endif -#if defined(need_GL_SGIX_polynomial_ffd) -static const char DeformationMap3dSGIX_names[] = - "iddiiddiiddiip\0" /* Parameter signature */ - "glDeformationMap3dSGIX\0" - ""; -#endif - #if defined(need_GL_VERSION_1_4) || defined(need_GL_EXT_fog_coord) static const char FogCoorddvEXT_names[] = "p\0" /* Parameter signature */ @@ -5319,13 +5319,13 @@ static const struct dri_extension_function GL_EXT_framebuffer_blit_functions[] = #if defined(need_GL_EXT_framebuffer_object) static const struct dri_extension_function GL_EXT_framebuffer_object_functions[] = { { GenerateMipmapEXT_names, GenerateMipmapEXT_remap_index, -1 }, + { IsRenderbufferEXT_names, IsRenderbufferEXT_remap_index, -1 }, { RenderbufferStorageEXT_names, RenderbufferStorageEXT_remap_index, -1 }, { CheckFramebufferStatusEXT_names, CheckFramebufferStatusEXT_remap_index, -1 }, { DeleteRenderbuffersEXT_names, DeleteRenderbuffersEXT_remap_index, -1 }, { FramebufferTexture3DEXT_names, FramebufferTexture3DEXT_remap_index, -1 }, { FramebufferRenderbufferEXT_names, FramebufferRenderbufferEXT_remap_index, -1 }, { FramebufferTexture1DEXT_names, FramebufferTexture1DEXT_remap_index, -1 }, - { IsRenderbufferEXT_names, IsRenderbufferEXT_remap_index, -1 }, { BindFramebufferEXT_names, BindFramebufferEXT_remap_index, -1 }, { GenRenderbuffersEXT_names, GenRenderbuffersEXT_remap_index, -1 }, { IsFramebufferEXT_names, IsFramebufferEXT_remap_index, -1 }, @@ -5965,9 +5965,9 @@ static const struct dri_extension_function GL_SGIX_pixel_texture_functions[] = { #if defined(need_GL_SGIX_polynomial_ffd) static const struct dri_extension_function GL_SGIX_polynomial_ffd_functions[] = { { LoadIdentityDeformationMapSGIX_names, LoadIdentityDeformationMapSGIX_remap_index, -1 }, + { DeformationMap3dSGIX_names, DeformationMap3dSGIX_remap_index, -1 }, { DeformSGIX_names, DeformSGIX_remap_index, -1 }, { DeformationMap3fSGIX_names, DeformationMap3fSGIX_remap_index, -1 }, - { DeformationMap3dSGIX_names, DeformationMap3dSGIX_remap_index, -1 }, { NULL, 0, 0 } }; #endif -- cgit v1.2.3