+ /* Vertex buffer object tests */
+ if (ctx->Array.ElementArrayBufferObj->Name) {
+ GLuint indexBytes;
+
+ /* use indices in the buffer object */
+ if (!ctx->Array.ElementArrayBufferObj->Size) {
+ _mesa_warning(ctx,
+ "glDrawElements called with empty array elements buffer");
+ return GL_FALSE;
+ }
+
+ /* make sure count doesn't go outside buffer bounds */
+ if (type == GL_UNSIGNED_INT) {
+ indexBytes = count * sizeof(GLuint);
+ }
+ else if (type == GL_UNSIGNED_BYTE) {
+ indexBytes = count * sizeof(GLubyte);
+ }
+ else {
+ ASSERT(type == GL_UNSIGNED_SHORT);
+ indexBytes = count * sizeof(GLushort);
+ }
+
+ if (indexBytes > ctx->Array.ElementArrayBufferObj->Size) {
+ _mesa_warning(ctx, "glDrawElements index out of buffer bounds");
+ return GL_FALSE;
+ }
+ }
+ else {
+ /* not using a VBO */
+ if (!indices)
+ return GL_FALSE;
+ }
+
+ if (ctx->Const.CheckArrayBounds) {
+ /* find max array index */
+ const GLubyte *map;
+ GLuint max = 0;
+ GLint i;
+
+ map = ctx->Driver.MapBuffer(ctx,
+ GL_ELEMENT_ARRAY_BUFFER_ARB,
+ GL_READ_ONLY,
+ ctx->Array.ElementArrayBufferObj);
+
+ /* Actual address is the sum of pointers */
+ indices = (const GLvoid *) ADD_POINTERS(map, (const GLubyte *) indices);
+
+ if (type == GL_UNSIGNED_INT) {
+ for (i = 0; i < count; i++)
+ if (((GLuint *) indices)[i] > max)
+ max = ((GLuint *) indices)[i];
+ }
+ else if (type == GL_UNSIGNED_SHORT) {
+ for (i = 0; i < count; i++)
+ if (((GLushort *) indices)[i] > max)
+ max = ((GLushort *) indices)[i];
+ }
+ else {
+ ASSERT(type == GL_UNSIGNED_BYTE);
+ for (i = 0; i < count; i++)
+ if (((GLubyte *) indices)[i] > max)
+ max = ((GLubyte *) indices)[i];
+ }
+
+ ctx->Driver.UnmapBuffer(ctx,
+ GL_ELEMENT_ARRAY_BUFFER_ARB,
+ ctx->Array.ElementArrayBufferObj);
+
+ if (max >= ctx->Array._MaxElement) {
+ /* the max element is out of bounds of one or more enabled arrays */
+ return GL_FALSE;
+ }
+ }
+