translate: fix buffer overflows

[mesa.git] / src / gallium / auxiliary / translate / translate_sse.c

diff --git a/src/gallium/auxiliary/translate/translate_sse.c b/src/gallium/auxiliary/translate/translate_sse.c
index b6bc22227d683254129b1cd3f6b52a54e9b2c181..1b698cd7c7c30917a2759242e37a90ea9860f052 100644 (file)
--- a/src/gallium/auxiliary/translate/translate_sse.c
+++ b/src/gallium/auxiliary/translate/translate_sse.c
@@ -104,15 +104,15 @@ struct translate_sse
    int8_t reg_to_const[16];
    int8_t const_to_reg[NUM_CONSTS];
 
-   struct translate_buffer buffer[PIPE_MAX_ATTRIBS];
+   struct translate_buffer buffer[TRANSLATE_MAX_ATTRIBS];
    unsigned nr_buffers;
 
    /* Multiple buffer variants can map to a single buffer. */
-   struct translate_buffer_variant buffer_variant[PIPE_MAX_ATTRIBS];
+   struct translate_buffer_variant buffer_variant[TRANSLATE_MAX_ATTRIBS];
    unsigned nr_buffer_variants;
 
    /* Multiple elements can map to a single buffer variant. */
-   unsigned element_to_buffer_variant[PIPE_MAX_ATTRIBS];
+   unsigned element_to_buffer_variant[TRANSLATE_MAX_ATTRIBS];
 
    boolean use_instancing;
    unsigned instance_id;
@@ -1494,6 +1494,8 @@ translate_sse2_create(const struct translate_key *key)
    p->translate.release = translate_sse_release;
    p->translate.set_buffer = translate_sse_set_buffer;
 
+   assert(key->nr_elements <= TRANSLATE_MAX_ATTRIBS);
+
    for (i = 0; i < key->nr_elements; i++) {
       if (key->element[i].type == TRANSLATE_ELEMENT_NORMAL) {
          unsigned j;