From 641dd03f15a876c23513a5eaaeee5275f041b5dc Mon Sep 17 00:00:00 2001 From: Marek Olšák Date: Tue, 3 Nov 2020 23:15:41 -0500 Subject: mesa: fix an overflow check for MultiDrawElements MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reviewed-by: Zoltán Böszörményi Reviewed-by: Pierre-Eric Pelloux-Prayer Part-of: --- src/mesa/main/draw.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/mesa/main/draw.c b/src/mesa/main/draw.c index 215d0dfff1b..915c24b6fac 100644 --- a/src/mesa/main/draw.c +++ b/src/mesa/main/draw.c @@ -1277,8 +1277,11 @@ _mesa_validated_multidrawelements(struct gl_context *ctx, GLenum mode, } if (ctx->Const.MultiDrawWithUserIndices) { - /* Check whether prim[i].start would overflow. */ - if (((max_index_ptr - min_index_ptr) >> ib.index_size_shift) > UINT_MAX) + /* "max_index_ptr - min_index_ptr >> index_size_shift" is stored + * in prims[i].start. The driver will multiply it later by index_size + * so make sure the final value won't overflow. + */ + if (max_index_ptr - min_index_ptr > UINT32_MAX) fallback = true; } else { /* If the index buffer isn't in a VBO, then treating the application's -- cgit v1.2.3