summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorEmil Velikov <emil.l.velikov@gmail.com>2014-01-15 11:39:24 +0000
committerCarl Worth <cworth@cworth.org>2014-01-25 16:38:37 -0800
commit45f0736aa56ecd6dc558ff73779c6f6bb8582c90 (patch)
tree440520628b6329079ff1350613dce97caf8a2b99 /src
parentb513c66a4ebd5b098bc409da8611af579c55076f (diff)
st/mesa: use signed temporary variable to store _ColorDrawBufferIndexes
The temporary variable used to store _ColorDrawBufferIndexes must be signed (GLint), otherwise the following conditional will be incorrectly evaluated. Leading to crashes in the driver/mesa or accessing/writing to arbitrary memory location. The bug dates back to 2009. Cc: 10.0 9.2 9.1 <mesa-stable@lists.freedesktop.org> Reviewed-by: Marek Olšák <marek.olsak@amd.com> Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com> (cherry picked from commit bfcf78c1101a1cbcdd9a479722203047c8d6c26a)
Diffstat (limited to 'src')
-rw-r--r--src/mesa/state_tracker/st_cb_clear.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/mesa/state_tracker/st_cb_clear.c b/src/mesa/state_tracker/st_cb_clear.c
index 391118a329d..5be4a898563 100644
--- a/src/mesa/state_tracker/st_cb_clear.c
+++ b/src/mesa/state_tracker/st_cb_clear.c
@@ -391,7 +391,7 @@ st_Clear(struct gl_context *ctx, GLbitfield mask)
if (mask & BUFFER_BITS_COLOR) {
for (i = 0; i < ctx->DrawBuffer->_NumColorDrawBuffers; i++) {
- GLuint b = ctx->DrawBuffer->_ColorDrawBufferIndexes[i];
+ GLint b = ctx->DrawBuffer->_ColorDrawBufferIndexes[i];
if (mask & (1 << b)) {
struct gl_renderbuffer *rb