fix for-loop in _mesa_GetDouble to avoid out of bounds memory read

[mesa.git] / src / mesa / main / polygon.c

diff --git a/src/mesa/main/polygon.c b/src/mesa/main/polygon.c
index 7fd6e6e96079c772403e824f873e27d5011d7b18..b771408cf368e0c6e540eb68e2b4cb73e6d01e56 100644 (file)
--- a/src/mesa/main/polygon.c
+++ b/src/mesa/main/polygon.c
@@ -196,7 +196,7 @@ _mesa_polygon_stipple(GLcontext *ctx, const GLubyte *pattern)
    if (ctx->Unpack.BufferObj->Name) {
       /* Get/unpack the stipple pattern from a PBO */
       GLubyte *buf;
-      if (!_mesa_validate_pbo_access(&ctx->Unpack, 32, 32, 1,
+      if (!_mesa_validate_pbo_access(2, &ctx->Unpack, 32, 32, 1,
                                      GL_COLOR_INDEX, GL_BITMAP, pattern)) {
          _mesa_error(ctx, GL_INVALID_OPERATION,
                      "glPolygonStipple(bad PBO access)");
@@ -261,7 +261,7 @@ _mesa_GetPolygonStipple( GLubyte *dest )
    if (ctx->Pack.BufferObj->Name) {
       /* Put/pack the stipple pattern into a PBO */
       GLubyte *buf;
-      if (!_mesa_validate_pbo_access(&ctx->Pack, 32, 32, 1,
+      if (!_mesa_validate_pbo_access(2, &ctx->Pack, 32, 32, 1,
                                      GL_COLOR_INDEX, GL_BITMAP, dest)) {
          _mesa_error(ctx, GL_INVALID_OPERATION,
                      "glGetPolygonStipple(bad PBO access)");
@@ -313,7 +313,8 @@ void GLAPIENTRY
 _mesa_PolygonOffsetEXT( GLfloat factor, GLfloat bias )
 {
    GET_CURRENT_CONTEXT(ctx);
-   _mesa_PolygonOffset(factor, bias * ctx->DepthMaxF );
+   /* XXX mult by DepthMaxF here??? */
+   _mesa_PolygonOffset(factor, bias * ctx->DrawBuffer->_DepthMaxF );
 }
 
 #endif