From d88f3b946804f9a3e8cad4f8896e6be488fec2b5 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 14:31:38 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameterfv.

_mesa_TexParameterfv calls set_tex_parameteri, which uses the
params argument as an array.
---
 src/mesa/main/texparam.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c
index 4ce8c8593a..4c1f690ff1 100644
--- a/src/mesa/main/texparam.c
+++ b/src/mesa/main/texparam.c
@@ -592,8 +592,10 @@ _mesa_TexParameterfv(GLenum target, GLenum pname, const GLfloat *params)
    case GL_DEPTH_TEXTURE_MODE_ARB:
       {
          /* convert float param to int */
-         GLint p = (GLint) params[0];
-         need_update = set_tex_parameteri(ctx, texObj, pname, &p);
+         GLint p[4];
+         p[0] = (GLint) params[0];
+         p[1] = p[2] = p[3] = 0;
+         need_update = set_tex_parameteri(ctx, texObj, pname, p);
       }
       break;
 
-- 
cgit v1.2.3


From a1d46fbea0b40d7edc668ea5993ea4318f37c9f9 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 15:42:13 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameteri.

_mesa_TexParameteri calls set_tex_parameterf, which uses the
params argument as an array.
---
 src/mesa/main/texparam.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c
index 4c1f690ff1..59c518c7d2 100644
--- a/src/mesa/main/texparam.c
+++ b/src/mesa/main/texparam.c
@@ -644,9 +644,11 @@ _mesa_TexParameteri(GLenum target, GLenum pname, GLint param)
    case GL_TEXTURE_LOD_BIAS:
    case GL_TEXTURE_COMPARE_FAIL_VALUE_ARB:
       {
-         GLfloat fparam = (GLfloat) param;
+         GLfloat fparam[4];
+         fparam[0] = (GLfloat) param;
+         fparam[1] = fparam[2] = fparam[3] = 0.0F;
          /* convert int param to float */
-         need_update = set_tex_parameterf(ctx, texObj, pname, &fparam);
+         need_update = set_tex_parameterf(ctx, texObj, pname, fparam);
       }
       break;
    default:
-- 
cgit v1.2.3


From 7f146b38240e1c4efa6d8d0a4e5a0c8346706de5 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 16:04:33 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_Fogi.

_mesa_Fogi calls _mesa_Fogfv, which uses the params argument
as an array.
---
 src/mesa/main/fog.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/fog.c b/src/mesa/main/fog.c
index 4323d3db82..99eb141812 100644
--- a/src/mesa/main/fog.c
+++ b/src/mesa/main/fog.c
@@ -41,8 +41,10 @@ _mesa_Fogf(GLenum pname, GLfloat param)
 void GLAPIENTRY
 _mesa_Fogi(GLenum pname, GLint param )
 {
-   GLfloat fparam = (GLfloat) param;
-   _mesa_Fogfv(pname, &fparam);
+   GLfloat fparam[4];
+   fparam[0] = (GLfloat) param;
+   fparam[1] = fparam[2] = fparam[3] = 0.0F;
+   _mesa_Fogfv(pname, fparam);
 }
 
 
-- 
cgit v1.2.3


From 3f7c2ac2798b385bed97b6931a1568a7e0223a0a Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 17:25:05 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameteri.

_mesa_TexParameteri calls set_tex_parameteri, which uses the
params argument as an array.
---
 src/mesa/main/texparam.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c
index 59c518c7d2..1cec4b82fe 100644
--- a/src/mesa/main/texparam.c
+++ b/src/mesa/main/texparam.c
@@ -653,7 +653,12 @@ _mesa_TexParameteri(GLenum target, GLenum pname, GLint param)
       break;
    default:
       /* this will generate an error if pname is illegal */
-      need_update = set_tex_parameteri(ctx, texObj, pname, &param);
+      {
+         GLint iparam[4];
+         iparam[0] = param;
+         iparam[1] = iparam[2] = iparam[3] = 0;
+         need_update = set_tex_parameteri(ctx, texObj, pname, iparam);
+      }
    }
 
    if (ctx->Driver.TexParameter && need_update) {
-- 
cgit v1.2.3


From d33bf38d63d233f6a09115acfff230c464d3ee29 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 17:51:07 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_Fogf.

_mesa_Fogf calls _mesa_Fogfv, which uses the params argument
as an array.
---
 src/mesa/main/fog.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/fog.c b/src/mesa/main/fog.c
index 99eb141812..269ff3f8b9 100644
--- a/src/mesa/main/fog.c
+++ b/src/mesa/main/fog.c
@@ -34,7 +34,10 @@
 void GLAPIENTRY
 _mesa_Fogf(GLenum pname, GLfloat param)
 {
-   _mesa_Fogfv(pname, &param);
+   GLfloat fparam[4];
+   fparam[0] = param;
+   fparam[1] = fparam[2] = fparam[3] = 0.0F;
+   _mesa_Fogfv(pname, fparam);
 }
 
 
-- 
cgit v1.2.3


From af16c822a5af8ce0aa7582e8ea44315b62b7356b Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 18:26:05 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_LightModeli.

_mesa_LightModeli calls _mesa_LightModeliv, which uses the
params argument as an array.
---
 src/mesa/main/light.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c
index 10c89f4368..5a8f9160f6 100644
--- a/src/mesa/main/light.c
+++ b/src/mesa/main/light.c
@@ -537,7 +537,10 @@ _mesa_LightModeliv( GLenum pname, const GLint *params )
 void GLAPIENTRY
 _mesa_LightModeli( GLenum pname, GLint param )
 {
-   _mesa_LightModeliv( pname, &param );
+   GLint iparam[4];
+   iparam[0] = param;
+   iparam[1] = iparam[2] = iparam[3] = 0;
+   _mesa_LightModeliv( pname, iparam );
 }
 
 
-- 
cgit v1.2.3


From cd6b8dd9e82fedc55d033131fbc0f8ee950567c8 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Wed, 9 Dec 2009 10:08:07 -0800
Subject: mesa: Move OES_read_format support from drivers into the core.

The assertion is that the correct read type to be using is the native
type of the underlying read renderbuffer.  For some fallback paths, this
may be worse than GL_RGBA/GL_UNSIGNED_BYTE for reads today, but it gets
all drivers the expected GL_BGRA/GL_UNSIGNED_BYTE for ARGB8888 or
GL_BGR//GL_UNSIGNED_SHORT_5_6_5_REV for rgb565 with no work.

This fixes the intel (and other) DRI drivers to report read formats that
should hit blit PBO readpixels paths.
---
 src/mesa/main/context.c             |  4 --
 src/mesa/main/framebuffer.c         | 26 ++++++++++
 src/mesa/main/framebuffer.h         |  5 ++
 src/mesa/main/get.c                 | 17 ++++---
 src/mesa/main/get_gen.py            |  5 +-
 src/mesa/main/mtypes.h              |  3 --
 src/mesa/sources.mak                |  1 -
 src/mesa/state_tracker/st_cb_get.c  | 97 -------------------------------------
 src/mesa/state_tracker/st_cb_get.h  | 37 --------------
 src/mesa/state_tracker/st_context.c |  2 -
 10 files changed, 43 insertions(+), 154 deletions(-)
 delete mode 100644 src/mesa/state_tracker/st_cb_get.c
 delete mode 100644 src/mesa/state_tracker/st_cb_get.h

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/context.c b/src/mesa/main/context.c
index b5bf46718f..87eae96639 100644
--- a/src/mesa/main/context.c
+++ b/src/mesa/main/context.c
@@ -564,10 +564,6 @@ _mesa_init_constants(GLcontext *ctx)
    /* GL_ARB_draw_buffers */
    ctx->Const.MaxDrawBuffers = MAX_DRAW_BUFFERS;
 
-   /* GL_OES_read_format */
-   ctx->Const.ColorReadFormat = GL_RGBA;
-   ctx->Const.ColorReadType = GL_UNSIGNED_BYTE;
-
 #if FEATURE_EXT_framebuffer_object
    ctx->Const.MaxColorAttachments = MAX_COLOR_ATTACHMENTS;
    ctx->Const.MaxRenderbufferSize = MAX_WIDTH;
diff --git a/src/mesa/main/framebuffer.c b/src/mesa/main/framebuffer.c
index 154dedacd5..d958dbf7d4 100644
--- a/src/mesa/main/framebuffer.c
+++ b/src/mesa/main/framebuffer.c
@@ -969,3 +969,29 @@ _mesa_dest_buffer_exists(GLcontext *ctx, GLenum format)
    /* OK */
    return GL_TRUE;
 }
+
+GLenum
+_mesa_get_color_read_format(GLcontext *ctx)
+{
+   switch (ctx->ReadBuffer->_ColorReadBuffer->Format) {
+   case MESA_FORMAT_ARGB8888:
+      return GL_BGRA;
+   case MESA_FORMAT_RGB565:
+      return GL_BGR;
+   default:
+      return GL_RGBA;
+   }
+}
+
+GLenum
+_mesa_get_color_read_type(GLcontext *ctx)
+{
+   switch (ctx->ReadBuffer->_ColorReadBuffer->Format) {
+   case MESA_FORMAT_ARGB8888:
+      return GL_UNSIGNED_BYTE;
+   case MESA_FORMAT_RGB565:
+      return GL_UNSIGNED_SHORT_5_6_5_REV;
+   default:
+      return GL_UNSIGNED_BYTE;
+   }
+}
diff --git a/src/mesa/main/framebuffer.h b/src/mesa/main/framebuffer.h
index 45a4703ba9..ef21dd98e8 100644
--- a/src/mesa/main/framebuffer.h
+++ b/src/mesa/main/framebuffer.h
@@ -81,5 +81,10 @@ _mesa_source_buffer_exists(GLcontext *ctx, GLenum format);
 extern GLboolean
 _mesa_dest_buffer_exists(GLcontext *ctx, GLenum format);
 
+extern GLenum
+_mesa_get_color_read_type(GLcontext *ctx);
+
+extern GLenum
+_mesa_get_color_read_format(GLcontext *ctx);
 
 #endif /* FRAMEBUFFER_H */
diff --git a/src/mesa/main/get.c b/src/mesa/main/get.c
index 6c5ce02913..3f6b03c88a 100644
--- a/src/mesa/main/get.c
+++ b/src/mesa/main/get.c
@@ -13,6 +13,7 @@
 #include "mtypes.h"
 #include "state.h"
 #include "texcompress.h"
+#include "framebuffer.h"
 
 
 #define FLOAT_TO_BOOLEAN(X)   ( (X) ? GL_TRUE : GL_FALSE )
@@ -1767,11 +1768,11 @@ _mesa_GetBooleanv( GLenum pname, GLboolean *params )
          break;
       case GL_IMPLEMENTATION_COLOR_READ_TYPE_OES:
          CHECK_EXT1(OES_read_format, "GetBooleanv");
-         params[0] = INT_TO_BOOLEAN(ctx->Const.ColorReadType);
+         params[0] = INT_TO_BOOLEAN(_mesa_get_color_read_type(ctx));
          break;
       case GL_IMPLEMENTATION_COLOR_READ_FORMAT_OES:
          CHECK_EXT1(OES_read_format, "GetBooleanv");
-         params[0] = INT_TO_BOOLEAN(ctx->Const.ColorReadFormat);
+         params[0] = INT_TO_BOOLEAN(_mesa_get_color_read_format(ctx));
          break;
       case GL_NUM_FRAGMENT_REGISTERS_ATI:
          CHECK_EXT1(ATI_fragment_shader, "GetBooleanv");
@@ -3602,11 +3603,11 @@ _mesa_GetFloatv( GLenum pname, GLfloat *params )
          break;
       case GL_IMPLEMENTATION_COLOR_READ_TYPE_OES:
          CHECK_EXT1(OES_read_format, "GetFloatv");
-         params[0] = (GLfloat)(ctx->Const.ColorReadType);
+         params[0] = (GLfloat)(_mesa_get_color_read_type(ctx));
          break;
       case GL_IMPLEMENTATION_COLOR_READ_FORMAT_OES:
          CHECK_EXT1(OES_read_format, "GetFloatv");
-         params[0] = (GLfloat)(ctx->Const.ColorReadFormat);
+         params[0] = (GLfloat)(_mesa_get_color_read_format(ctx));
          break;
       case GL_NUM_FRAGMENT_REGISTERS_ATI:
          CHECK_EXT1(ATI_fragment_shader, "GetFloatv");
@@ -5437,11 +5438,11 @@ _mesa_GetIntegerv( GLenum pname, GLint *params )
          break;
       case GL_IMPLEMENTATION_COLOR_READ_TYPE_OES:
          CHECK_EXT1(OES_read_format, "GetIntegerv");
-         params[0] = ctx->Const.ColorReadType;
+         params[0] = _mesa_get_color_read_type(ctx);
          break;
       case GL_IMPLEMENTATION_COLOR_READ_FORMAT_OES:
          CHECK_EXT1(OES_read_format, "GetIntegerv");
-         params[0] = ctx->Const.ColorReadFormat;
+         params[0] = _mesa_get_color_read_format(ctx);
          break;
       case GL_NUM_FRAGMENT_REGISTERS_ATI:
          CHECK_EXT1(ATI_fragment_shader, "GetIntegerv");
@@ -7273,11 +7274,11 @@ _mesa_GetInteger64v( GLenum pname, GLint64 *params )
          break;
       case GL_IMPLEMENTATION_COLOR_READ_TYPE_OES:
          CHECK_EXT1(OES_read_format, "GetInteger64v");
-         params[0] = (GLint64)(ctx->Const.ColorReadType);
+         params[0] = (GLint64)(_mesa_get_color_read_type(ctx));
          break;
       case GL_IMPLEMENTATION_COLOR_READ_FORMAT_OES:
          CHECK_EXT1(OES_read_format, "GetInteger64v");
-         params[0] = (GLint64)(ctx->Const.ColorReadFormat);
+         params[0] = (GLint64)(_mesa_get_color_read_format(ctx));
          break;
       case GL_NUM_FRAGMENT_REGISTERS_ATI:
          CHECK_EXT1(ATI_fragment_shader, "GetInteger64v");
diff --git a/src/mesa/main/get_gen.py b/src/mesa/main/get_gen.py
index 930c3362fa..697c4cfd92 100644
--- a/src/mesa/main/get_gen.py
+++ b/src/mesa/main/get_gen.py
@@ -942,9 +942,9 @@ StateVars = [
 
 	# GL_OES_read_format
 	( "GL_IMPLEMENTATION_COLOR_READ_TYPE_OES", GLint,
-	  ["ctx->Const.ColorReadType"], "", ["OES_read_format"] ),
+	  ["_mesa_get_color_read_type(ctx)"], "", ["OES_read_format"] ),
 	( "GL_IMPLEMENTATION_COLOR_READ_FORMAT_OES", GLint,
-	  ["ctx->Const.ColorReadFormat"], "", ["OES_read_format"] ),
+	  ["_mesa_get_color_read_format(ctx)"], "", ["OES_read_format"] ),
 
 	# GL_ATI_fragment_shader
 	( "GL_NUM_FRAGMENT_REGISTERS_ATI", GLint, ["6"], "", ["ATI_fragment_shader"] ),
@@ -1159,6 +1159,7 @@ def EmitHeader():
 #include "mtypes.h"
 #include "state.h"
 #include "texcompress.h"
+#include "framebuffer.h"
 
 
 #define FLOAT_TO_BOOLEAN(X)   ( (X) ? GL_TRUE : GL_FALSE )
diff --git a/src/mesa/main/mtypes.h b/src/mesa/main/mtypes.h
index 881d233ca3..cde2f5fe06 100644
--- a/src/mesa/main/mtypes.h
+++ b/src/mesa/main/mtypes.h
@@ -2355,9 +2355,6 @@ struct gl_constants
 
    GLuint MaxDrawBuffers;    /**< GL_ARB_draw_buffers */
 
-   GLenum ColorReadFormat;   /**< GL_OES_read_format */
-   GLenum ColorReadType;     /**< GL_OES_read_format */
-
    GLuint MaxColorAttachments;   /**< GL_EXT_framebuffer_object */
    GLuint MaxRenderbufferSize;   /**< GL_EXT_framebuffer_object */
    GLuint MaxSamples;            /**< GL_ARB_framebuffer_object */
diff --git a/src/mesa/sources.mak b/src/mesa/sources.mak
index 615a5588ea..a0d7dbbace 100644
--- a/src/mesa/sources.mak
+++ b/src/mesa/sources.mak
@@ -191,7 +191,6 @@ STATETRACKER_SOURCES = \
 	state_tracker/st_cb_bufferobjects.c \
 	state_tracker/st_cb_clear.c \
 	state_tracker/st_cb_flush.c \
-	state_tracker/st_cb_get.c \
 	state_tracker/st_cb_drawpixels.c \
 	state_tracker/st_cb_fbo.c \
 	state_tracker/st_cb_feedback.c \
diff --git a/src/mesa/state_tracker/st_cb_get.c b/src/mesa/state_tracker/st_cb_get.c
deleted file mode 100644
index e7d7f03bc9..0000000000
--- a/src/mesa/state_tracker/st_cb_get.c
+++ /dev/null
@@ -1,97 +0,0 @@
-/**************************************************************************
- * 
- * Copyright 2008 Tungsten Graphics, Inc., Cedar Park, Texas.
- * All Rights Reserved.
- * 
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sub license, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- * 
- * The above copyright notice and this permission notice (including the
- * next paragraph) shall be included in all copies or substantial portions
- * of the Software.
- * 
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
- * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.
- * IN NO EVENT SHALL TUNGSTEN GRAPHICS AND/OR ITS SUPPLIERS BE LIABLE FOR
- * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
- * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
- * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- * 
- **************************************************************************/
-
-
-/**
- * glGet functions
- *
- * \author Brian Paul
- */
-
-#include "main/imports.h"
-#include "main/context.h"
-
-#include "pipe/p_defines.h"
-
-#include "st_cb_fbo.h"
-#include "st_cb_get.h"
-
-
-
-/**
- * Examine the current color read buffer format to determine
- * which GL pixel format/type combo is the best match.
- */
-static void
-get_preferred_read_format_type(GLcontext *ctx, GLint *format, GLint *type)
-{
-   struct gl_framebuffer *fb = ctx->ReadBuffer;
-   struct st_renderbuffer *strb = st_renderbuffer(fb->_ColorReadBuffer);
-
-   /* defaults */
-   *format = ctx->Const.ColorReadFormat;
-   *type = ctx->Const.ColorReadType;
-
-   if (strb) {
-      /* XXX could add more cases here... */
-      if (strb->format == PIPE_FORMAT_A8R8G8B8_UNORM) {
-         *format = GL_BGRA;
-         if (_mesa_little_endian())
-            *type = GL_UNSIGNED_INT_8_8_8_8_REV;
-         else
-            *type = GL_UNSIGNED_INT_8_8_8_8;
-      }
-   }
-}
-
-
-/**
- * We only intercept the OES preferred ReadPixels format/type.
- * Everything else goes to the default _mesa_GetIntegerv.
- */
-static GLboolean 
-st_GetIntegerv(GLcontext *ctx, GLenum pname, GLint *params)
-{
-   GLint dummy;
-
-   switch (pname) {
-   case GL_IMPLEMENTATION_COLOR_READ_TYPE_OES:
-      get_preferred_read_format_type(ctx, &dummy, params);
-      return GL_TRUE;
-   case GL_IMPLEMENTATION_COLOR_READ_FORMAT_OES:
-      get_preferred_read_format_type(ctx, params, &dummy);
-      return GL_TRUE;
-   default:
-      return GL_FALSE;
-   }
-}
-
-
-void st_init_get_functions(struct dd_function_table *functions)
-{
-   functions->GetIntegerv = st_GetIntegerv;
-}
diff --git a/src/mesa/state_tracker/st_cb_get.h b/src/mesa/state_tracker/st_cb_get.h
deleted file mode 100644
index 8e9f3e9306..0000000000
--- a/src/mesa/state_tracker/st_cb_get.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/**************************************************************************
- * 
- * Copyright 2008 Tungsten Graphics, Inc., Cedar Park, Texas.
- * All Rights Reserved.
- * 
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the
- * "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish,
- * distribute, sub license, and/or sell copies of the Software, and to
- * permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- * 
- * The above copyright notice and this permission notice (including the
- * next paragraph) shall be included in all copies or substantial portions
- * of the Software.
- * 
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
- * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.
- * IN NO EVENT SHALL TUNGSTEN GRAPHICS AND/OR ITS SUPPLIERS BE LIABLE FOR
- * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
- * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
- * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- * 
- **************************************************************************/
-
-
-#ifndef ST_CB_GET_H
-#define ST_CB_GET_H
-
-
-extern void
-st_init_get_functions(struct dd_function_table *functions);
-
-
-#endif
diff --git a/src/mesa/state_tracker/st_context.c b/src/mesa/state_tracker/st_context.c
index f0eddafd33..d18a25ab51 100644
--- a/src/mesa/state_tracker/st_context.c
+++ b/src/mesa/state_tracker/st_context.c
@@ -51,7 +51,6 @@
 #include "st_cb_drawtex.h"
 #endif
 #include "st_cb_fbo.h"
-#include "st_cb_get.h"
 #if FEATURE_feedback
 #include "st_cb_feedback.h"
 #endif
@@ -331,7 +330,6 @@ void st_init_driver_functions(struct dd_function_table *functions)
    st_init_rasterpos_functions(functions);
 #endif
    st_init_fbo_functions(functions);
-   st_init_get_functions(functions);
 #if FEATURE_feedback
    st_init_feedback_functions(functions);
 #endif
-- 
cgit v1.2.3


From 3de8fff45d04fd7e702cd656ba97cafd348c3981 Mon Sep 17 00:00:00 2001
From: Brian Paul <brianp@vmware.com>
Date: Wed, 9 Dec 2009 08:30:01 -0700
Subject: mesa: fix baseLevel >= MAX_TEXTURE_LEVELS test

This fixes invalid array indexing when baseLevel == MAX_TEXTURE_LEVELS.
See bug 25528.
---
 src/mesa/main/texobj.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/texobj.c b/src/mesa/main/texobj.c
index da55ac8697..85f5f78e50 100644
--- a/src/mesa/main/texobj.c
+++ b/src/mesa/main/texobj.c
@@ -418,7 +418,7 @@ _mesa_test_texobj_completeness( const GLcontext *ctx,
    /* Detect cases where the application set the base level to an invalid
     * value.
     */
-   if ((baseLevel < 0) || (baseLevel > MAX_TEXTURE_LEVELS)) {
+   if ((baseLevel < 0) || (baseLevel >= MAX_TEXTURE_LEVELS)) {
       char s[100];
       _mesa_sprintf(s, "base level = %d is invalid", baseLevel);
       incomplete(t, s);
-- 
cgit v1.2.3


From 637970aefdcdd1ee50e3759de384b82e6109a45c Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Wed, 9 Dec 2009 12:43:28 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_LightModelf.

_mesa_LightModelf calls _mesa_LightModelfv, which uses the
params argument as an array.
---
 src/mesa/main/light.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c
index 5a8f9160f6..c1d47de330 100644
--- a/src/mesa/main/light.c
+++ b/src/mesa/main/light.c
@@ -547,7 +547,10 @@ _mesa_LightModeli( GLenum pname, GLint param )
 void GLAPIENTRY
 _mesa_LightModelf( GLenum pname, GLfloat param )
 {
-   _mesa_LightModelfv( pname, &param );
+   GLfloat fparam[4];
+   fparam[0] = param;
+   fparam[1] = fparam[2] = fparam[3] = 0.0F;
+   _mesa_LightModelfv( pname, fparam );
 }
 
 
-- 
cgit v1.2.3


From 6f2d51b81ff907af9727e90153a46e79e246fc66 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Wed, 9 Dec 2009 13:00:22 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_PointParameterf.

_mesa_PointParameterf calls _mesa_PointParameterfv, which uses the
params argument as an array.
---
 src/mesa/main/points.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/points.c b/src/mesa/main/points.c
index b330544890..9ec21c9b76 100644
--- a/src/mesa/main/points.c
+++ b/src/mesa/main/points.c
@@ -90,7 +90,10 @@ _mesa_PointParameteriv( GLenum pname, const GLint *params )
 void GLAPIENTRY
 _mesa_PointParameterf( GLenum pname, GLfloat param)
 {
-   _mesa_PointParameterfv(pname, &param);
+   GLfloat p[3];
+   p[0] = param;
+   p[1] = p[2] = 0.0F;
+   _mesa_PointParameterfv(pname, p);
 }
 
 
-- 
cgit v1.2.3


From 348883076bd213ec733a1ba2a4768788e4669c97 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Wed, 9 Dec 2009 13:15:05 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_PointParameteri.

_mesa_PointParameteri calls _mesa_PointParameterfv, which uses the
params argument as an array.
---
 src/mesa/main/points.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/points.c b/src/mesa/main/points.c
index 9ec21c9b76..dcaeccd90d 100644
--- a/src/mesa/main/points.c
+++ b/src/mesa/main/points.c
@@ -69,8 +69,10 @@ _mesa_PointSize( GLfloat size )
 void GLAPIENTRY
 _mesa_PointParameteri( GLenum pname, GLint param )
 {
-   const GLfloat value = (GLfloat) param;
-   _mesa_PointParameterfv(pname, &value);
+   GLfloat p[3];
+   p[0] = (GLfloat) param;
+   p[1] = p[2] = 0.0F;
+   _mesa_PointParameterfv(pname, p);
 }
 
 
-- 
cgit v1.2.3


From 34528a34c446afea4442f479713e7f926220f128 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Wed, 9 Dec 2009 17:11:30 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_Lightf.

---
 src/mesa/main/light.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c
index c1d47de330..d4f3bb9026 100644
--- a/src/mesa/main/light.c
+++ b/src/mesa/main/light.c
@@ -206,7 +206,10 @@ _mesa_light(GLcontext *ctx, GLuint lnum, GLenum pname, const GLfloat *params)
 void GLAPIENTRY
 _mesa_Lightf( GLenum light, GLenum pname, GLfloat param )
 {
-   _mesa_Lightfv( light, pname, &param );
+   GLfloat fparam[4];
+   fparam[0] = param;
+   fparam[1] = fparam[2] = fparam[3] = 0.0F;
+   _mesa_Lightfv( light, pname, fparam );
 }
 
 
-- 
cgit v1.2.3


From 444d1f39108ab4419843f19f76c968cef3398bab Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Wed, 9 Dec 2009 17:34:50 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_Lighti.

_mesa_Lighti calls _mesa_Lightiv, which uses the params argument
as an array.
---
 src/mesa/main/light.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c
index d4f3bb9026..5150926159 100644
--- a/src/mesa/main/light.c
+++ b/src/mesa/main/light.c
@@ -288,7 +288,10 @@ _mesa_Lightfv( GLenum light, GLenum pname, const GLfloat *params )
 void GLAPIENTRY
 _mesa_Lighti( GLenum light, GLenum pname, GLint param )
 {
-   _mesa_Lightiv( light, pname, &param );
+   GLint iparam[4];
+   iparam[0] = param;
+   iparam[1] = iparam[2] = iparam[3] = 0;
+   _mesa_Lightiv( light, pname, iparam );
 }
 
 
-- 
cgit v1.2.3


From b82757880545f8bce471ba8f13c16998888cd4b5 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Wed, 9 Dec 2009 17:59:23 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_TexGend.

_mesa_TexGend calls _mesa_TexGenfv, which uses the params argument
as an array.
---
 src/mesa/main/texgen.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/texgen.c b/src/mesa/main/texgen.c
index d3ea7b936b..f9d38215d6 100644
--- a/src/mesa/main/texgen.c
+++ b/src/mesa/main/texgen.c
@@ -181,8 +181,10 @@ _mesa_TexGeniv(GLenum coord, GLenum pname, const GLint *params )
 void GLAPIENTRY
 _mesa_TexGend(GLenum coord, GLenum pname, GLdouble param )
 {
-   GLfloat p = (GLfloat) param;
-   _mesa_TexGenfv( coord, pname, &p );
+   GLfloat p[4];
+   p[0] = (GLfloat) param;
+   p[1] = p[2] = p[3] = 0.0F;
+   _mesa_TexGenfv( coord, pname, p );
 }
 
 
-- 
cgit v1.2.3


From dcb4a37fc89924192d923ed6906d2922371b8cb1 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Thu, 10 Dec 2009 12:11:09 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameteriv.

---
 src/mesa/main/texparam.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'src/mesa/main')

diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c
index 1cec4b82fe..0f83d226f2 100644
--- a/src/mesa/main/texparam.c
+++ b/src/mesa/main/texparam.c
@@ -700,8 +700,10 @@ _mesa_TexParameteriv(GLenum target, GLenum pname, const GLint *params)
    case GL_TEXTURE_COMPARE_FAIL_VALUE_ARB:
       {
          /* convert int param to float */
-         GLfloat fparam = (GLfloat) params[0];
-         need_update = set_tex_parameterf(ctx, texObj, pname, &fparam);
+         GLfloat fparams[4];
+         fparams[0] = (GLfloat) params[0];
+         fparams[1] = fparams[2] = fparams[3] = 0.0F;
+         need_update = set_tex_parameterf(ctx, texObj, pname, fparams);
       }
       break;
    default:
-- 
cgit v1.2.3