mesa: Fix array out-of-bounds access by _mesa_TexParameteri.

[mesa.git] / src / mesa / main / histogram.c

diff --git a/src/mesa/main/histogram.c b/src/mesa/main/histogram.c
index 77c458d540c054eeb95f83d21caebddd6489757c..2b3e62c7d5e243c88e92a17f06ca495c29cb435d 100644 (file)
--- a/src/mesa/main/histogram.c
+++ b/src/mesa/main/histogram.c
@@ -186,16 +186,17 @@ pack_histogram( GLcontext *ctx,
          {
             /* temporarily store as GLuints */
             GLuint temp[4*HISTOGRAM_TABLE_SIZE];
-            GLhalfARB *dst = (GLhalfARB *) destination;
+            GLuint *dst = temp;
+            GLhalfARB *half = (GLhalfARB *) destination;
             GLuint i;
             /* get GLuint values */
             PACK_MACRO(GLuint);
             /* convert to GLhalf */
             for (i = 0; i < n * comps; i++) {
-               dst[i] = _mesa_float_to_half((GLfloat) temp[i]);
+               half[i] = _mesa_float_to_half((GLfloat) temp[i]);
             }
             if (packing->SwapBytes) {
-               _mesa_swap2((GLushort *) dst, n * comps);
+               _mesa_swap2((GLushort *) half, n * comps);
             }
          }
          break;
@@ -649,29 +650,11 @@ _mesa_GetMinmax(GLenum target, GLboolean reset, GLenum format, GLenum type, GLvo
       return;
    }
 
-   if (ctx->Pack.BufferObj->Name) {
-      /* pack min/max values into a PBO */
-      GLubyte *buf;
-      if (!_mesa_validate_pbo_access(1, &ctx->Pack, 2, 1, 1,
-                                     format, type, values)) {
-         _mesa_error(ctx, GL_INVALID_OPERATION,
-                     "glGetMinMax(invalid PBO access)");
-         return;
-      }
-      buf = (GLubyte *) ctx->Driver.MapBuffer(ctx, GL_PIXEL_PACK_BUFFER_EXT,
-                                              GL_WRITE_ONLY_ARB,
-                                              ctx->Pack.BufferObj);
-      if (!buf) {
-         /* buffer is already mapped - that's an error */
-         _mesa_error(ctx, GL_INVALID_OPERATION,"glGetMinMax(PBO is mapped)");
-         return;
-      }
-      values = ADD_POINTERS(buf, values);
-   }
-   else if (!values) {
-      /* not an error */
+
+   values = _mesa_map_validate_pbo_dest(ctx, 1, &ctx->Pack, 2, 1, 1,
+                                        format, type, values, "glGetMinmax");
+   if (!values)
       return;
-   }
 
    {
       GLfloat minmax[2][4];
@@ -687,10 +670,7 @@ _mesa_GetMinmax(GLenum target, GLboolean reset, GLenum format, GLenum type, GLvo
                                  format, type, values, &ctx->Pack, 0x0);
    }
 
-   if (ctx->Pack.BufferObj->Name) {
-      ctx->Driver.UnmapBuffer(ctx, GL_PIXEL_PACK_BUFFER_EXT,
-                              ctx->Pack.BufferObj);
-   }
+   _mesa_unmap_pbo_dest(ctx, &ctx->Pack);
 
    if (reset) {
       _mesa_ResetMinmax(GL_MINMAX);
@@ -733,38 +713,18 @@ _mesa_GetHistogram(GLenum target, GLboolean reset, GLenum format, GLenum type, G
       return;
    }
 
-   if (ctx->Pack.BufferObj->Name) {
-      /* pack min/max values into a PBO */
-      GLubyte *buf;
-      if (!_mesa_validate_pbo_access(1, &ctx->Pack, ctx->Histogram.Width, 1, 1,
-                                     format, type, values)) {
-         _mesa_error(ctx, GL_INVALID_OPERATION,
-                     "glGetHistogram(invalid PBO access)");
-         return;
-      }
-      buf = (GLubyte *) ctx->Driver.MapBuffer(ctx, GL_PIXEL_PACK_BUFFER_EXT,
-                                              GL_WRITE_ONLY_ARB,
-                                              ctx->Pack.BufferObj);
-      if (!buf) {
-         /* buffer is already mapped - that's an error */
-         _mesa_error(ctx,GL_INVALID_OPERATION,"glGetHistogram(PBO is mapped)");
-         return;
-      }
-      values = ADD_POINTERS(buf, values);
-   }
-   else if (!values) {
-      /* not an error */
+   values = _mesa_map_validate_pbo_dest(ctx, 1, &ctx->Pack,
+                                        ctx->Histogram.Width, 1, 1,
+                                        format, type, values,
+                                        "glGetHistogram");
+   if (!values)
       return;
-   }
 
    pack_histogram(ctx, ctx->Histogram.Width,
                   (CONST GLuint (*)[4]) ctx->Histogram.Count,
                   format, type, values, &ctx->Pack);
 
-   if (ctx->Pack.BufferObj->Name) {
-      ctx->Driver.UnmapBuffer(ctx, GL_PIXEL_PACK_BUFFER_EXT,
-                              ctx->Pack.BufferObj);
-   }
+   _mesa_unmap_pbo_dest(ctx, &ctx->Pack);
 
    if (reset) {
       GLuint i;
@@ -955,7 +915,7 @@ _mesa_Histogram(GLenum target, GLsizei width, GLenum internalFormat, GLboolean s
       }
    }
 
-   if (width != 0 && _mesa_bitcount(width) != 1) {
+   if (width != 0 && !_mesa_is_pow_two(width)) {
       if (target == GL_PROXY_HISTOGRAM) {
          error = GL_TRUE;
       }
@@ -975,6 +935,8 @@ _mesa_Histogram(GLenum target, GLsizei width, GLenum internalFormat, GLboolean s
       }
    }
 
+   FLUSH_VERTICES(ctx, _NEW_PIXEL);
+
    /* reset histograms */
    for (i = 0; i < HISTOGRAM_TABLE_SIZE; i++) {
       ctx->Histogram.Count[i][0] = 0;
@@ -1002,8 +964,6 @@ _mesa_Histogram(GLenum target, GLsizei width, GLenum internalFormat, GLboolean s
       ctx->Histogram.AlphaSize     = 8 * sizeof(GLuint);
       ctx->Histogram.LuminanceSize = 8 * sizeof(GLuint);
    }
-
-   ctx->NewState |= _NEW_PIXEL;
 }
 
 
@@ -1058,8 +1018,6 @@ _mesa_ResetHistogram(GLenum target)
       ctx->Histogram.Count[i][2] = 0;
       ctx->Histogram.Count[i][3] = 0;
    }
-
-   ctx->NewState |= _NEW_PIXEL;
 }
 
 
@@ -1083,7 +1041,6 @@ _mesa_ResetMinmax(GLenum target)
    ctx->MinMax.Min[GCOMP] = 1000;    ctx->MinMax.Max[GCOMP] = -1000;
    ctx->MinMax.Min[BCOMP] = 1000;    ctx->MinMax.Max[BCOMP] = -1000;
    ctx->MinMax.Min[ACOMP] = 1000;    ctx->MinMax.Max[ACOMP] = -1000;
-   ctx->NewState |= _NEW_PIXEL;
 }