From d88f3b946804f9a3e8cad4f8896e6be488fec2b5 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Tue, 8 Dec 2009 14:31:38 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameterfv. _mesa_TexParameterfv calls set_tex_parameteri, which uses the params argument as an array. --- src/mesa/main/texparam.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/mesa/main/texparam.c') diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c index 4ce8c8593a..4c1f690ff1 100644 --- a/src/mesa/main/texparam.c +++ b/src/mesa/main/texparam.c @@ -592,8 +592,10 @@ _mesa_TexParameterfv(GLenum target, GLenum pname, const GLfloat *params) case GL_DEPTH_TEXTURE_MODE_ARB: { /* convert float param to int */ - GLint p = (GLint) params[0]; - need_update = set_tex_parameteri(ctx, texObj, pname, &p); + GLint p[4]; + p[0] = (GLint) params[0]; + p[1] = p[2] = p[3] = 0; + need_update = set_tex_parameteri(ctx, texObj, pname, p); } break; -- cgit v1.2.3 From a1d46fbea0b40d7edc668ea5993ea4318f37c9f9 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Tue, 8 Dec 2009 15:42:13 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameteri. _mesa_TexParameteri calls set_tex_parameterf, which uses the params argument as an array. --- src/mesa/main/texparam.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/mesa/main/texparam.c') diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c index 4c1f690ff1..59c518c7d2 100644 --- a/src/mesa/main/texparam.c +++ b/src/mesa/main/texparam.c @@ -644,9 +644,11 @@ _mesa_TexParameteri(GLenum target, GLenum pname, GLint param) case GL_TEXTURE_LOD_BIAS: case GL_TEXTURE_COMPARE_FAIL_VALUE_ARB: { - GLfloat fparam = (GLfloat) param; + GLfloat fparam[4]; + fparam[0] = (GLfloat) param; + fparam[1] = fparam[2] = fparam[3] = 0.0F; /* convert int param to float */ - need_update = set_tex_parameterf(ctx, texObj, pname, &fparam); + need_update = set_tex_parameterf(ctx, texObj, pname, fparam); } break; default: -- cgit v1.2.3 From 3f7c2ac2798b385bed97b6931a1568a7e0223a0a Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Tue, 8 Dec 2009 17:25:05 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameteri. _mesa_TexParameteri calls set_tex_parameteri, which uses the params argument as an array. --- src/mesa/main/texparam.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'src/mesa/main/texparam.c') diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c index 59c518c7d2..1cec4b82fe 100644 --- a/src/mesa/main/texparam.c +++ b/src/mesa/main/texparam.c @@ -653,7 +653,12 @@ _mesa_TexParameteri(GLenum target, GLenum pname, GLint param) break; default: /* this will generate an error if pname is illegal */ - need_update = set_tex_parameteri(ctx, texObj, pname, ¶m); + { + GLint iparam[4]; + iparam[0] = param; + iparam[1] = iparam[2] = iparam[3] = 0; + need_update = set_tex_parameteri(ctx, texObj, pname, iparam); + } } if (ctx->Driver.TexParameter && need_update) { -- cgit v1.2.3 From dcb4a37fc89924192d923ed6906d2922371b8cb1 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Thu, 10 Dec 2009 12:11:09 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameteriv. --- src/mesa/main/texparam.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/mesa/main/texparam.c') diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c index 1cec4b82fe..0f83d226f2 100644 --- a/src/mesa/main/texparam.c +++ b/src/mesa/main/texparam.c @@ -700,8 +700,10 @@ _mesa_TexParameteriv(GLenum target, GLenum pname, const GLint *params) case GL_TEXTURE_COMPARE_FAIL_VALUE_ARB: { /* convert int param to float */ - GLfloat fparam = (GLfloat) params[0]; - need_update = set_tex_parameterf(ctx, texObj, pname, &fparam); + GLfloat fparams[4]; + fparams[0] = (GLfloat) params[0]; + fparams[1] = fparams[2] = fparams[3] = 0.0F; + need_update = set_tex_parameterf(ctx, texObj, pname, fparams); } break; default: -- cgit v1.2.3