fix for-loop in _mesa_GetDouble to avoid out of bounds memory read

[mesa.git] / src / mesa / main / polygon.c

diff --git a/src/mesa/main/polygon.c b/src/mesa/main/polygon.c
index 1051c8ce17948dd957b14a44c504391f570cff03..b771408cf368e0c6e540eb68e2b4cb73e6d01e56 100644 (file)
--- a/src/mesa/main/polygon.c
+++ b/src/mesa/main/polygon.c
@@ -5,9 +5,9 @@
 
 /*
  * Mesa 3-D graphics library
- * Version:  4.1
+ * Version:  6.3
  *
- * Copyright (C) 1999-2002  Brian Paul   All Rights Reserved.
+ * Copyright (C) 1999-2004  Brian Paul   All Rights Reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the "Software"),
@@ -30,6 +30,7 @@
 
 #include "glheader.h"
 #include "imports.h"
+#include "bufferobj.h"
 #include "context.h"
 #include "image.h"
 #include "enums.h"
@@ -49,7 +50,7 @@
  * change, flushes the vertices and notifies the driver via
  * the dd_function_table::CullFace callback.
  */
-void
+void GLAPIENTRY
 _mesa_CullFace( GLenum mode )
 {
    GET_CURRENT_CONTEXT(ctx);
@@ -85,7 +86,7 @@ _mesa_CullFace( GLenum mode )
  * flushes the vertices and notifies the driver via
  * the dd_function_table::FrontFace callback.
  */
-void
+void GLAPIENTRY
 _mesa_FrontFace( GLenum mode )
 {
    GET_CURRENT_CONTEXT(ctx);
@@ -124,7 +125,7 @@ _mesa_FrontFace( GLenum mode )
  * gl_polygon_attrib::BackMode. On change flushes the vertices and notifies the
  * driver via the dd_function_table::PolygonMode callback.
  */
-void
+void GLAPIENTRY
 _mesa_PolygonMode( GLenum face, GLenum mode )
 {
    GET_CURRENT_CONTEXT(ctx);
@@ -177,7 +178,54 @@ _mesa_PolygonMode( GLenum face, GLenum mode )
 
 #if _HAVE_FULL_GL
 
+
+/**
+ * This routine updates the ctx->Polygon.Stipple state.
+ * If we're getting the stipple data from a PBO, we map the buffer
+ * in order to access the data.
+ * In any case, we obey the current pixel unpacking parameters when fetching
+ * the stipple data.
+ *
+ * In the future, this routine should be used as a fallback, called via
+ * ctx->Driver.PolygonStipple().  We'll have to update all the DRI drivers
+ * too.
+ */
 void
+_mesa_polygon_stipple(GLcontext *ctx, const GLubyte *pattern)
+{
+   if (ctx->Unpack.BufferObj->Name) {
+      /* Get/unpack the stipple pattern from a PBO */
+      GLubyte *buf;
+      if (!_mesa_validate_pbo_access(2, &ctx->Unpack, 32, 32, 1,
+                                     GL_COLOR_INDEX, GL_BITMAP, pattern)) {
+         _mesa_error(ctx, GL_INVALID_OPERATION,
+                     "glPolygonStipple(bad PBO access)");
+         return;
+      }
+      buf = (GLubyte *) ctx->Driver.MapBuffer(ctx, GL_PIXEL_UNPACK_BUFFER_EXT,
+                                              GL_READ_ONLY_ARB,
+                                              ctx->Unpack.BufferObj);
+      if (!buf) {
+         _mesa_error(ctx, GL_INVALID_OPERATION,
+                     "glPolygonStipple(PBO mapped)");
+         return;
+      }
+      buf = ADD_POINTERS(buf, pattern);
+      _mesa_unpack_polygon_stipple(buf, ctx->PolygonStipple, &ctx->Unpack);
+      ctx->Driver.UnmapBuffer(ctx, GL_PIXEL_UNPACK_BUFFER_EXT,
+                              ctx->Unpack.BufferObj);
+   }
+   else {
+      /* Get/unpack the stipple pattern from user memory */
+      _mesa_unpack_polygon_stipple(pattern, ctx->PolygonStipple, &ctx->Unpack);
+   }
+}
+
+
+/**
+ * Called by glPolygonStipple.
+ */
+void GLAPIENTRY
 _mesa_PolygonStipple( const GLubyte *pattern )
 {
    GET_CURRENT_CONTEXT(ctx);
@@ -187,15 +235,18 @@ _mesa_PolygonStipple( const GLubyte *pattern )
       _mesa_debug(ctx, "glPolygonStipple\n");
 
    FLUSH_VERTICES(ctx, _NEW_POLYGONSTIPPLE);
-   _mesa_unpack_polygon_stipple(pattern, ctx->PolygonStipple, &ctx->Unpack);
+
+   _mesa_polygon_stipple(ctx, pattern);
 
    if (ctx->Driver.PolygonStipple)
-      ctx->Driver.PolygonStipple( ctx, (const GLubyte *) ctx->PolygonStipple );
+      ctx->Driver.PolygonStipple(ctx, pattern);
 }
 
 
-
-void
+/**
+ * Called by glPolygonStipple.
+ */
+void GLAPIENTRY
 _mesa_GetPolygonStipple( GLubyte *dest )
 {
    GET_CURRENT_CONTEXT(ctx);
@@ -204,11 +255,39 @@ _mesa_GetPolygonStipple( GLubyte *dest )
    if (MESA_VERBOSE&VERBOSE_API)
       _mesa_debug(ctx, "glGetPolygonStipple\n");
 
-   _mesa_pack_polygon_stipple(ctx->PolygonStipple, dest, &ctx->Pack);
+   /* XXX someday we may put this code into a separate function and call
+    * it with ctx->Driver.GetPolygonStipple().
+    */
+   if (ctx->Pack.BufferObj->Name) {
+      /* Put/pack the stipple pattern into a PBO */
+      GLubyte *buf;
+      if (!_mesa_validate_pbo_access(2, &ctx->Pack, 32, 32, 1,
+                                     GL_COLOR_INDEX, GL_BITMAP, dest)) {
+         _mesa_error(ctx, GL_INVALID_OPERATION,
+                     "glGetPolygonStipple(bad PBO access)");
+         return;
+      }
+      buf = (GLubyte *) ctx->Driver.MapBuffer(ctx, GL_PIXEL_PACK_BUFFER_EXT,
+                                              GL_WRITE_ONLY_ARB,
+                                              ctx->Pack.BufferObj);
+      if (!buf) {
+         _mesa_error(ctx, GL_INVALID_OPERATION,
+                     "glGetPolygonStipple(PBO mapped)");
+         return;
+      }
+      buf = ADD_POINTERS(buf, dest);
+      _mesa_pack_polygon_stipple(ctx->PolygonStipple, buf, &ctx->Pack);
+      ctx->Driver.UnmapBuffer(ctx, GL_PIXEL_PACK_BUFFER_EXT,
+                              ctx->Pack.BufferObj);
+   }
+   else {
+      /* Put/pack the stipple pattern into user memory */
+      _mesa_pack_polygon_stipple(ctx->PolygonStipple, dest, &ctx->Pack);
+   }
 }
 
 
-void
+void GLAPIENTRY
 _mesa_PolygonOffset( GLfloat factor, GLfloat units )
 {
    GET_CURRENT_CONTEXT(ctx);
@@ -230,12 +309,12 @@ _mesa_PolygonOffset( GLfloat factor, GLfloat units )
 }
 
 
-
-void
+void GLAPIENTRY
 _mesa_PolygonOffsetEXT( GLfloat factor, GLfloat bias )
 {
    GET_CURRENT_CONTEXT(ctx);
-   _mesa_PolygonOffset(factor, bias * ctx->DepthMaxF );
+   /* XXX mult by DepthMaxF here??? */
+   _mesa_PolygonOffset(factor, bias * ctx->DrawBuffer->_DepthMaxF );
 }
 
 #endif