Skip to content
Snippets Groups Projects
Commit 45f0736a authored by Emil Velikov's avatar Emil Velikov Committed by Carl Worth
Browse files

st/mesa: use signed temporary variable to store _ColorDrawBufferIndexes


The temporary variable used to store _ColorDrawBufferIndexes must be
signed (GLint), otherwise the following conditional will be incorrectly
evaluated. Leading to crashes in the driver/mesa or accessing/writing
to arbitrary memory location. The bug dates back to 2009.

Cc: 10.0 9.2 9.1 <mesa-stable@lists.freedesktop.org>
Reviewed-by: default avatarMarek Olšák <marek.olsak@amd.com>
Signed-off-by: default avatarEmil Velikov <emil.l.velikov@gmail.com>
(cherry picked from commit bfcf78c1)
parent b513c66a
No related branches found
Tags mesa-22.0.3
No related merge requests found
......@@ -391,7 +391,7 @@ st_Clear(struct gl_context *ctx, GLbitfield mask)
if (mask & BUFFER_BITS_COLOR) {
for (i = 0; i < ctx->DrawBuffer->_NumColorDrawBuffers; i++) {
GLuint b = ctx->DrawBuffer->_ColorDrawBufferIndexes[i];
GLint b = ctx->DrawBuffer->_ColorDrawBufferIndexes[i];
if (mask & (1 << b)) {
struct gl_renderbuffer *rb
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment