diff options
author | Chad Versace <chad.versace@linux.intel.com> | 2012-01-18 15:56:58 -0800 |
---|---|---|
committer | Ian Romanick <ian.d.romanick@intel.com> | 2012-01-27 17:43:21 -0800 |
commit | 889f756c2864df9428289f11a9ad837147e6d963 (patch) | |
tree | 4f044cc95b077028d5ecff7af6ea7f17342a7942 | |
parent | e10c47adffb0371cba3d6a2c80313489e6fa8767 (diff) |
swrast: Fix unsigned promotion in pointer arithmetic
When rowstride was negatie, unsigned promotion caused a segfault here:
299│ if (rb->Format == MESA_FORMAT_S8) {
300│ const GLuint rowStride = rb->RowStride;
301│ for (i = 0; i < count; i++) {
302│ if (x[i] >= 0 && y[i] >= 0 && x[i] < w && y[i] < h) {
303├> stencil[i] = *(map + y[i] * rowStride + x[i]);
304│ }
305│ }
306│ }
Fixes segfault in oglconform
separatestencil-neu(NonPolygon.BothFacesBitmapCoreAPI),
though test still fails.
Note: This is a candidate for the stable branches.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=43327
Reviewed-by: Brian Paul <brianp@vmware.com>
Signed-off-by: Chad Versace <chad.versace@linux.intel.com>
(cherry picked from commit aed5c8299fe47b8e1728f8140d069bc89d3fa947)
-rw-r--r-- | src/mesa/swrast/s_stencil.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/mesa/swrast/s_stencil.c b/src/mesa/swrast/s_stencil.c index dbcbd2be069..fb95ef14df3 100644 --- a/src/mesa/swrast/s_stencil.c +++ b/src/mesa/swrast/s_stencil.c @@ -297,7 +297,7 @@ get_s8_values(struct gl_context *ctx, struct gl_renderbuffer *rb, GLuint i; if (rb->Format == MESA_FORMAT_S8) { - const GLuint rowStride = rb->RowStride; + const GLint rowStride = rb->RowStride; for (i = 0; i < count; i++) { if (x[i] >= 0 && y[i] >= 0 && x[i] < w && y[i] < h) { stencil[i] = *(map + y[i] * rowStride + x[i]); @@ -305,8 +305,8 @@ get_s8_values(struct gl_context *ctx, struct gl_renderbuffer *rb, } } else { - const GLuint bpp = _mesa_get_format_bytes(rb->Format); - const GLuint rowStride = rb->RowStride * bpp; + const GLint bpp = _mesa_get_format_bytes(rb->Format); + const GLint rowStride = rb->RowStride * bpp; for (i = 0; i < count; i++) { if (x[i] >= 0 && y[i] >= 0 && x[i] < w && y[i] < h) { const GLubyte *src = map + y[i] * rowStride + x[i] * bpp; |