Otherwise, a pointer greater than the size would underflow and give a large
maximum element.
---
src/mesa/main/varray.c | 16 +++++++++++-----
1 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/src/mesa/main/varray.c b/src/mesa/main/varray.c
index 106252e..3127c03 100644
--- a/src/mesa/main/varray.c
+++ b/src/mesa/main/varray.c
@@ -71,11 +71,17 @@ update_array(GLcontext *ctx, struct gl_client_array *array,
* Later in glDrawArrays we'll check if start + count > _MaxElement to
* be sure we won't go out of bounds.
*/
- if (ctx->Array.ArrayBufferObj->Name)
- array->_MaxElement = ((GLsizeiptrARB) ctx->Array.ArrayBufferObj->Size
- - (GLsizeiptrARB) array->Ptr + array->StrideB
- - elementSize) / array->StrideB;
- else
+ if (ctx->Array.ArrayBufferObj->Name) {
+ GLsizeiptrARB offset = (GLsizeiptrARB) array->Ptr;
+ GLsizeiptrARB obj_size = (GLsizeiptrARB) array->BufferObj->Size;
+
+ if (offset < obj_size) {
+ array->_MaxElement = (obj_size - offset +
+ array->StrideB - elementSize) / array->StrideB;
+ } else {
+ array->_MaxElement = 0;
+ }
+ } else
#endif
array->_MaxElement = 2 * 1000 * 1000 * 1000; /* just a big number */
--
1.5.6.5
------------------------------------------------------------------------------
Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA
-OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise
-Strategies to boost innovation and cut costs with open source participation
-Receive a $600 discount off the registration fee with the source code: SFAD
http://p.sf.net/sfu/XcvMzF8H
_______________________________________________
Mesa3d-dev mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mesa3d-dev
