fix for-loop in _mesa_GetDouble to avoid out of bounds memory read

[mesa.git] / src / mesa / main / varray.c

diff --git a/src/mesa/main/varray.c b/src/mesa/main/varray.c
index 04d0a07e286e19ebbf25dcf6314a1a3980008a33..404302873b375a8964a5b9d483023a09bf1b463e 100644 (file)
--- a/src/mesa/main/varray.c
+++ b/src/mesa/main/varray.c
@@ -60,6 +60,7 @@ update_array(GLcontext *ctx, struct gl_client_array *array,
 #if FEATURE_ARB_vertex_buffer_object
    array->BufferObj->RefCount--;
    if (array->BufferObj->RefCount <= 0) {
+      ASSERT(array->BufferObj->Name);
       _mesa_remove_buffer_object( ctx, array->BufferObj );
       (*ctx->Driver.DeleteBuffer)( ctx, array->BufferObj );
    }