diff options
author | Tapani Pälli <tapani.palli@intel.com> | 2019-02-14 09:02:31 +0200 |
---|---|---|
committer | Dylan Baker <dylan@pnwbakers.com> | 2019-02-19 07:08:42 -0800 |
commit | 0a2e4b02ca6f0bf4b198b10a2752fb33064f44ab (patch) | |
tree | dd858b76969c76cd5a8aa6964926aad40e249641 | |
parent | c7fc61d15b5db5340dfe3eca633c8fc86d81b0d4 (diff) |
mesa: return NULL if we exceed MaxColorAttachments in get_fb_attachment
This fixes invalid access to Attachment array which would occur if caller
would exceed MaxColorAttachments. In practice this should not ever happen
because DiscardFramebufferEXT specifies only GL_COLOR_ATTACHMENT0 to be
valid and InvalidateFramebuffer will error out before but this should
make coverity happy.
v2: const, remove _EXT (Ian)
CID: 1442559
Fixes: 0c42b5f3cb9 "mesa: wire up InvalidateFramebuffer"
Signed-off-by: Tapani Pälli <tapani.palli@intel.com>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
(cherry picked from commit 9762a9f89380a8070654a80e73d927297c29da35)
-rw-r--r-- | src/mesa/main/fbobject.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/mesa/main/fbobject.c b/src/mesa/main/fbobject.c index 87c33be7854..341fd93efc6 100644 --- a/src/mesa/main/fbobject.c +++ b/src/mesa/main/fbobject.c @@ -4663,8 +4663,12 @@ get_fb_attachment(struct gl_context *ctx, struct gl_framebuffer *fb, case GL_COLOR_ATTACHMENT12: case GL_COLOR_ATTACHMENT13: case GL_COLOR_ATTACHMENT14: - case GL_COLOR_ATTACHMENT15: - return &fb->Attachment[BUFFER_COLOR0 + attachment - GL_COLOR_ATTACHMENT0]; + case GL_COLOR_ATTACHMENT15: { + const unsigned i = attachment - GL_COLOR_ATTACHMENT0; + if (i >= ctx->Const.MaxColorAttachments) + return NULL; + return &fb->Attachment[BUFFER_COLOR0 + i]; + } case GL_DEPTH: case GL_DEPTH_ATTACHMENT: case GL_DEPTH_STENCIL_ATTACHMENT: |