Commit 9762a9f8 authored by Tapani Pälli's avatar Tapani Pälli
Browse files

mesa: return NULL if we exceed MaxColorAttachments in get_fb_attachment

This fixes invalid access to Attachment array which would occur if caller
would exceed MaxColorAttachments. In practice this should not ever happen
because DiscardFramebufferEXT specifies only GL_COLOR_ATTACHMENT0 to be
valid and InvalidateFramebuffer will error out before but this should
make coverity happy.

v2: const, remove _EXT (Ian)

CID: 1442559
Fixes: 0c42b5f3

 "mesa: wire up InvalidateFramebuffer"
Signed-off-by: Tapani Pälli's avatarTapani Pälli <tapani.palli@intel.com>
Reviewed-by: default avatarIan Romanick <ian.d.romanick@intel.com>
parent 2c6a7fbe
......@@ -4663,8 +4663,12 @@ get_fb_attachment(struct gl_context *ctx, struct gl_framebuffer *fb,
case GL_COLOR_ATTACHMENT12:
case GL_COLOR_ATTACHMENT13:
case GL_COLOR_ATTACHMENT14:
case GL_COLOR_ATTACHMENT15:
return &fb->Attachment[BUFFER_COLOR0 + attachment - GL_COLOR_ATTACHMENT0];
case GL_COLOR_ATTACHMENT15: {
const unsigned i = attachment - GL_COLOR_ATTACHMENT0;
if (i >= ctx->Const.MaxColorAttachments)
return NULL;
return &fb->Attachment[BUFFER_COLOR0 + i];
}
case GL_DEPTH:
case GL_DEPTH_ATTACHMENT:
case GL_DEPTH_STENCIL_ATTACHMENT:
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment