diff options
| -rw-r--r-- | .pick_status.json | 2 | ||||
| -rw-r--r-- | src/mesa/main/fbobject.c | 6 |
2 files changed, 6 insertions, 2 deletions
diff --git a/.pick_status.json b/.pick_status.json index 1eb7605ff8b..9ecf25f2131 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -1786,7 +1786,7 @@ "description": "mesa: fix out of bounds access in glGetFramebufferParameterivEXT", "nominated": true, "nomination_type": 1, - "resolution": 0, + "resolution": 1, "master_sha": null, "because_sha": "7534c536ca0f4b2b123200f421460094034f37a3" }, diff --git a/src/mesa/main/fbobject.c b/src/mesa/main/fbobject.c index 298a6b35d0a..e43d07b2b8c 100644 --- a/src/mesa/main/fbobject.c +++ b/src/mesa/main/fbobject.c @@ -4814,7 +4814,11 @@ _mesa_GetFramebufferParameterivEXT(GLuint framebuffer, GLenum pname, *param = fb->ColorReadBuffer; } else if (GL_DRAW_BUFFER0 <= pname && pname <= GL_DRAW_BUFFER15) { - *param = fb->ColorDrawBuffer[pname - GL_DRAW_BUFFER0]; + unsigned buffer = pname - GL_DRAW_BUFFER0; + if (buffer < ARRAY_SIZE(fb->ColorDrawBuffer)) + *param = fb->ColorDrawBuffer[buffer]; + else + _mesa_error(ctx, GL_INVALID_ENUM, "glGetFramebufferParameterivEXT(pname)"); } else { _mesa_error(ctx, GL_INVALID_ENUM, "glGetFramebufferParameterivEXT(pname)"); |