Module: Mesa Branch: master Commit: 23d75936a72b9a9b9e1d04a901a86a75d93dbffb URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=23d75936a72b9a9b9e1d04a901a86a75d93dbffb
Author: José Fonseca <[email protected]> Date: Wed Apr 6 15:10:19 2011 +0100 mesa/st: Prevent 'end' < 'start' in vbo_exec_DrawRangeElementsBaseVertex() We adjust 'end' to fit into _MaxElement, but that may result into a 'start' value bigger than 'end' being passed downstream, causing havoc. This could be seen with arb_robustness_draw-vbo-bounds, due to an application bug. --- src/mesa/vbo/vbo_exec_array.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/src/mesa/vbo/vbo_exec_array.c b/src/mesa/vbo/vbo_exec_array.c index 98d6bad..6e26e4e 100644 --- a/src/mesa/vbo/vbo_exec_array.c +++ b/src/mesa/vbo/vbo_exec_array.c @@ -943,8 +943,13 @@ vbo_exec_DrawRangeElementsBaseVertex(GLenum mode, /* Set 'end' to the max possible legal value */ assert(ctx->Array.ArrayObj->_MaxElement >= 1); end = ctx->Array.ArrayObj->_MaxElement - 1; + + if (end < start) { + return; + } } - else if (0) { + + if (0) { printf("glDraw[Range]Elements{,BaseVertex}" "(start %u, end %u, type 0x%x, count %d) ElemBuf %u, " "base %d\n", _______________________________________________ mesa-commit mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/mesa-commit
