fix for-loop in _mesa_GetDouble to avoid out of bounds memory read

[mesa.git] / src / mesa / main / varray.c

diff --git a/src/mesa/main/varray.c b/src/mesa/main/varray.c
index 52f8c8cef95b23a902dca4e2223db36c090c09e4..404302873b375a8964a5b9d483023a09bf1b463e 100644 (file)
--- a/src/mesa/main/varray.c
+++ b/src/mesa/main/varray.c
@@ -1,8 +1,8 @@
 /*
  * Mesa 3-D graphics library
- * Version:  5.1
+ * Version:  6.1
  *
- * Copyright (C) 1999-2003  Brian Paul   All Rights Reserved.
+ * Copyright (C) 1999-2004  Brian Paul   All Rights Reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the "Software"),
@@ -60,6 +60,7 @@ update_array(GLcontext *ctx, struct gl_client_array *array,
 #if FEATURE_ARB_vertex_buffer_object
    array->BufferObj->RefCount--;
    if (array->BufferObj->RefCount <= 0) {
+      ASSERT(array->BufferObj->Name);
       _mesa_remove_buffer_object( ctx, array->BufferObj );
       (*ctx->Driver.DeleteBuffer)( ctx, array->BufferObj );
    }
@@ -625,7 +626,6 @@ _mesa_InterleavedArrays(GLenum format, GLsizei stride, const GLvoid *pointer)
    const GLint toffset = 0;        /* always zero */
    GLint defstride;                /* default stride */
    GLint c, f;
-   GLint coordUnitSave;
 
    ASSERT_OUTSIDE_BEGIN_END_AND_FLUSH(ctx);
 
@@ -756,31 +756,14 @@ _mesa_InterleavedArrays(GLenum format, GLsizei stride, const GLvoid *pointer)
    _mesa_DisableClientState( GL_INDEX_ARRAY );
 
    /* Texcoords */
-   coordUnitSave = ctx->Array.ActiveTexture;
    if (tflag) {
-      GLuint i=0;
-      /* enable unit 0 texcoord array */
-      _mesa_ClientActiveTextureARB( GL_TEXTURE0_ARB );
       _mesa_EnableClientState( GL_TEXTURE_COORD_ARRAY );
       _mesa_TexCoordPointer( tcomps, GL_FLOAT, stride,
-                             (GLubyte *) pointer + i * toffset );
-      /* disable all other texcoord arrays */
-      for (i = 1; i < ctx->Const.MaxTextureCoordUnits; i++) {
-         _mesa_ClientActiveTextureARB( (GLenum) (GL_TEXTURE0_ARB + i) );
-         _mesa_DisableClientState( GL_TEXTURE_COORD_ARRAY );
-      }
+                             (GLubyte *) pointer + toffset );
    }
    else {
-      /* disable all texcoord arrays */
-      GLuint i;
-      for (i = 0; i < ctx->Const.MaxTextureCoordUnits; i++) {
-         _mesa_ClientActiveTextureARB( (GLenum) (GL_TEXTURE0_ARB + i) );
-         _mesa_DisableClientState( GL_TEXTURE_COORD_ARRAY );
-      }
+      _mesa_DisableClientState( GL_TEXTURE_COORD_ARRAY );
    }
-   /* Restore texture coordinate unit index */
-   _mesa_ClientActiveTextureARB( (GLenum) (GL_TEXTURE0_ARB + coordUnitSave) );
-
 
    /* Color */
    if (cflag) {