summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorBrian Paul <brianp@vmware.com>2009-05-22 07:10:47 -0600
committerBrian Paul <brianp@vmware.com>2009-06-17 11:30:03 -0600
commite913821b1460db79e85d97819f5cbbce4a86bb3d (patch)
treecb811b20cc1b2ed211268408e4bb7b2498031739 /src
parent46eb4e0cde08e43684d5a02bb0f6cc92175b03d2 (diff)
vbo: fix incorrect loop limit in bind_array_obj()
The generic_array[] is 16 elements in size, but the loop was doing 32 iterations. The out of bounds array write was clobbering the following inputs[] array but as luck would have it, that didn't matter. (cherry picked from commit 8da09e6924ca22ba7951d5a7673dfab2a711a997)
Diffstat (limited to 'src')
-rw-r--r--src/mesa/vbo/vbo_exec_array.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/src/mesa/vbo/vbo_exec_array.c b/src/mesa/vbo/vbo_exec_array.c
index 8871e10cf60..2bbf00e7b95 100644
--- a/src/mesa/vbo/vbo_exec_array.c
+++ b/src/mesa/vbo/vbo_exec_array.c
@@ -116,8 +116,11 @@ static void bind_array_obj( GLcontext *ctx )
for (i = 0; i < 8; i++)
exec->array.legacy_array[VERT_ATTRIB_TEX0 + i] = &ctx->Array.ArrayObj->TexCoord[i];
- for (i = 0; i < VERT_ATTRIB_MAX; i++)
+ for (i = 0; i < MAX_VERTEX_ATTRIBS; i++) {
+ assert(i < Elements(ctx->Array.ArrayObj->VertexAttrib));
+ assert(i < Elements(exec->array.generic_array));
exec->array.generic_array[i] = &ctx->Array.ArrayObj->VertexAttrib[i];
+ }
exec->array.array_obj = ctx->Array.ArrayObj->Name;
}