fix for-loop in _mesa_GetDouble to avoid out of bounds memory read

[mesa.git] / src / mesa / main / image.c

diff --git a/src/mesa/main/image.c b/src/mesa/main/image.c
index 5e65bf6f8ec4837928d1ebd822bfd8f974dbf316..12f8352c2d2629f7688aeb6d5bd22a42e21366c4 100644 (file)
--- a/src/mesa/main/image.c
+++ b/src/mesa/main/image.c
@@ -4177,7 +4177,7 @@ _mesa_clip_readpixels(const GLcontext *ctx,
       *srcX = 0;
    }
    /* right clipping */
-   if (*srcX + *width > buffer->Width)
+   if (*srcX + *width > (GLsizei) buffer->Width)
       *width -= (*srcX + *width - buffer->Width);
 
    if (*width <= 0)
@@ -4190,7 +4190,7 @@ _mesa_clip_readpixels(const GLcontext *ctx,
       *srcY = 0;
    }
    /* top clipping */
-   if (*srcY + *height > buffer->Height)
+   if (*srcY + *height > (GLsizei) buffer->Height)
       *height -= (*srcY + *height - buffer->Height);
 
    if (*height <= 0)