Commit d3020027 authored by Marcin Ślusarz's avatar Marcin Ślusarz Committed by Eric Engestrom
Browse files

mesa: fix out of bounds access in glGetFramebufferParameterivEXT



ColorDrawBuffer is an array of MAX_DRAW_BUFFERS == 8.

Found by Coverity.
Signed-off-by: Marcin Ślusarz's avatarMarcin Ślusarz <marcin.slusarz@intel.com>
Fixes: 7534c536

 ("mesa: add EXT_dsa (Named)Framebuffer functions")
Reviewed-by: default avatarMarek Olšák <marek.olsak@amd.com>
Part-of: <!6067>
(cherry picked from commit 0906d5d5)
parent 6a4460a1
......@@ -220,7 +220,7 @@
"description": "mesa: fix out of bounds access in glGetFramebufferParameterivEXT",
"nominated": true,
"nomination_type": 1,
"resolution": 0,
"resolution": 1,
"master_sha": null,
"because_sha": "7534c536ca0f4b2b123200f421460094034f37a3"
},
......@@ -4814,7 +4814,11 @@ _mesa_GetFramebufferParameterivEXT(GLuint framebuffer, GLenum pname,
*param = fb->ColorReadBuffer;
}
else if (GL_DRAW_BUFFER0 <= pname && pname <= GL_DRAW_BUFFER15) {
*param = fb->ColorDrawBuffer[pname - GL_DRAW_BUFFER0];
unsigned buffer = pname - GL_DRAW_BUFFER0;
if (buffer < ARRAY_SIZE(fb->ColorDrawBuffer))
*param = fb->ColorDrawBuffer[buffer];
else
_mesa_error(ctx, GL_INVALID_ENUM, "glGetFramebufferParameterivEXT(pname)");
}
else {
_mesa_error(ctx, GL_INVALID_ENUM, "glGetFramebufferParameterivEXT(pname)");
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment