diff options
| author | Marcin Ślusarz <marcin.slusarz@intel.com> | 2020-07-24 19:19:07 +0200 |
|---|---|---|
| committer | Eric Engestrom <eric@engestrom.ch> | 2020-08-05 22:23:21 +0200 |
| commit | 3af72354feef361980d0fb028e29d66f5525d8e0 (patch) | |
| tree | 641e8b5bd0d38ce66e74cafbcafa8b76b5492cf3 | |
| parent | f2de23e7855cd5346acd3ea32c987ea88e5545db (diff) | |
mesa: fix out of bounds access in glGetFramebufferParameterivEXT
ColorDrawBuffer is an array of MAX_DRAW_BUFFERS == 8.
Found by Coverity.
Signed-off-by: Marcin Ślusarz <marcin.slusarz@intel.com>
Fixes: 7534c536ca0 ("mesa: add EXT_dsa (Named)Framebuffer functions")
Reviewed-by: Marek Olšák <marek.olsak@amd.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/6067>
(cherry picked from commit 0906d5d504eb0209556787b020a6df58b4cc3069)
| -rw-r--r-- | .pick_status.json | 2 | ||||
| -rw-r--r-- | src/mesa/main/fbobject.c | 6 |
2 files changed, 6 insertions, 2 deletions
diff --git a/.pick_status.json b/.pick_status.json index 1eb7605ff8b..9ecf25f2131 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -1786,7 +1786,7 @@ "description": "mesa: fix out of bounds access in glGetFramebufferParameterivEXT", "nominated": true, "nomination_type": 1, - "resolution": 0, + "resolution": 1, "master_sha": null, "because_sha": "7534c536ca0f4b2b123200f421460094034f37a3" }, diff --git a/src/mesa/main/fbobject.c b/src/mesa/main/fbobject.c index 298a6b35d0a..e43d07b2b8c 100644 --- a/src/mesa/main/fbobject.c +++ b/src/mesa/main/fbobject.c @@ -4814,7 +4814,11 @@ _mesa_GetFramebufferParameterivEXT(GLuint framebuffer, GLenum pname, *param = fb->ColorReadBuffer; } else if (GL_DRAW_BUFFER0 <= pname && pname <= GL_DRAW_BUFFER15) { - *param = fb->ColorDrawBuffer[pname - GL_DRAW_BUFFER0]; + unsigned buffer = pname - GL_DRAW_BUFFER0; + if (buffer < ARRAY_SIZE(fb->ColorDrawBuffer)) + *param = fb->ColorDrawBuffer[buffer]; + else + _mesa_error(ctx, GL_INVALID_ENUM, "glGetFramebufferParameterivEXT(pname)"); } else { _mesa_error(ctx, GL_INVALID_ENUM, "glGetFramebufferParameterivEXT(pname)"); |