vbo: fix array index out of bounds error, and fix evaluator priorities

[mesa.git] / src / mesa / main / renderbuffer.c

diff --git a/src/mesa/main/renderbuffer.c b/src/mesa/main/renderbuffer.c
index 1145e91e3b4bc0e155bd7c431122d17403fa8edf..5bef7c84fb203ececf97b686b9e3c60f3ba879f9 100644 (file)
--- a/src/mesa/main/renderbuffer.c
+++ b/src/mesa/main/renderbuffer.c
@@ -1199,7 +1199,8 @@ _mesa_soft_renderbuffer_storage(GLcontext *ctx, struct gl_renderbuffer *rb,
 
    if (width > 0 && height > 0) {
       /* allocate new buffer storage */
-      rb->Data = _mesa_malloc(width * height * pixelSize);
+      rb->Data = malloc(width * height * pixelSize);
+
       if (rb->Data == NULL) {
          rb->Width = 0;
          rb->Height = 0;
@@ -1471,6 +1472,7 @@ _mesa_init_renderbuffer(struct gl_renderbuffer *rb, GLuint name)
 {
    _glthread_INIT_MUTEX(rb->Mutex);
 
+   rb->Magic = RB_MAGIC;
    rb->ClassID = 0;
    rb->Name = name;
    rb->RefCount = 0;
@@ -1486,11 +1488,16 @@ _mesa_init_renderbuffer(struct gl_renderbuffer *rb, GLuint name)
    rb->InternalFormat = GL_NONE;
    rb->_ActualFormat = GL_NONE;
    rb->_BaseFormat = GL_NONE;
-   rb->DataType = GL_NONE;
+
+   rb->ComponentType = GL_UNSIGNED_NORMALIZED; /* ARB_fbo */
+   rb->ColorEncoding = GL_LINEAR; /* ARB_fbo */
+
    rb->RedBits = rb->GreenBits = rb->BlueBits = rb->AlphaBits = 0;
    rb->IndexBits = 0;
    rb->DepthBits = 0;
    rb->StencilBits = 0;
+
+   rb->DataType = GL_NONE;
    rb->Data = NULL;
 
    /* Point back to ourself so that we don't have to check for Wrapped==NULL
@@ -1948,7 +1955,7 @@ _mesa_add_aux_renderbuffers(GLcontext *ctx, struct gl_framebuffer *fb,
       return GL_FALSE;
    }
 
-   assert(numBuffers < MAX_AUX_BUFFERS);
+   assert(numBuffers <= MAX_AUX_BUFFERS);
 
    for (i = 0; i < numBuffers; i++) {
       struct gl_renderbuffer *rb = _mesa_new_renderbuffer(ctx, 0);
@@ -2149,21 +2156,26 @@ _mesa_reference_renderbuffer(struct gl_renderbuffer **ptr,
       GLboolean deleteFlag = GL_FALSE;
       struct gl_renderbuffer *oldRb = *ptr;
 
+      assert(oldRb->Magic == RB_MAGIC);
       _glthread_LOCK_MUTEX(oldRb->Mutex);
+      assert(oldRb->Magic == RB_MAGIC);
       ASSERT(oldRb->RefCount > 0);
       oldRb->RefCount--;
       /*printf("RB DECR %p (%d) to %d\n", (void*) oldRb, oldRb->Name, oldRb->RefCount);*/
       deleteFlag = (oldRb->RefCount == 0);
       _glthread_UNLOCK_MUTEX(oldRb->Mutex);
 
-      if (deleteFlag)
+      if (deleteFlag) {
+         oldRb->Magic = 0; /* now invalid memory! */
          oldRb->Delete(oldRb);
+      }
 
       *ptr = NULL;
    }
    assert(!*ptr);
 
    if (rb) {
+      assert(rb->Magic == RB_MAGIC);
       /* reference new renderbuffer */
       _glthread_LOCK_MUTEX(rb->Mutex);
       rb->RefCount++;