diff options
| author | Emil Velikov <emil.l.velikov@gmail.com> | 2014-01-15 11:39:24 +0000 |
|---|---|---|
| committer | Emil Velikov <emil.l.velikov@gmail.com> | 2014-01-15 14:33:28 +0000 |
| commit | bfcf78c1101a1cbcdd9a479722203047c8d6c26a (patch) | |
| tree | e71e4aa3f053e543140ab5e8a09b7bf3528fa156 /src/mesa | |
| parent | 3515a648a95134e04234f98d6630c2067069f1d6 (diff) | |
st/mesa: use signed temporary variable to store _ColorDrawBufferIndexes
The temporary variable used to store _ColorDrawBufferIndexes must be
signed (GLint), otherwise the following conditional will be incorrectly
evaluated. Leading to crashes in the driver/mesa or accessing/writing
to arbitrary memory location. The bug dates back to 2009.
Cc: 10.0 9.2 9.1 <mesa-stable@lists.freedesktop.org>
Reviewed-by: Marek Olšák <marek.olsak@amd.com>
Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Diffstat (limited to 'src/mesa')
| -rw-r--r-- | src/mesa/state_tracker/st_cb_clear.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/mesa/state_tracker/st_cb_clear.c b/src/mesa/state_tracker/st_cb_clear.c index 87dccee1f49..79124b3daa4 100644 --- a/src/mesa/state_tracker/st_cb_clear.c +++ b/src/mesa/state_tracker/st_cb_clear.c @@ -444,7 +444,7 @@ st_Clear(struct gl_context *ctx, GLbitfield mask) if (mask & BUFFER_BITS_COLOR) { for (i = 0; i < ctx->DrawBuffer->_NumColorDrawBuffers; i++) { - GLuint b = ctx->DrawBuffer->_ColorDrawBufferIndexes[i]; + GLint b = ctx->DrawBuffer->_ColorDrawBufferIndexes[i]; if (b >= 0 && mask & (1 << b)) { struct gl_renderbuffer *rb |