Merge branch 'mesa_7_5_branch'

[mesa.git] / src / mesa / vbo / vbo_exec_array.c

diff --git a/src/mesa/vbo/vbo_exec_array.c b/src/mesa/vbo/vbo_exec_array.c
index 65fe197a4d7d79f1f1fe7bd14b4e890f6c6ad57b..66a4ed7a4057c048d5919073775db1413fa15b95 100644 (file)
--- a/src/mesa/vbo/vbo_exec_array.c
+++ b/src/mesa/vbo/vbo_exec_array.c
@@ -103,7 +103,7 @@ static void bind_array_obj( GLcontext *ctx )
     * go away.
     */
    exec->array.legacy_array[VERT_ATTRIB_POS] = &arrayObj->Vertex;
-   exec->array.legacy_array[VERT_ATTRIB_WEIGHT] = &vbo->legacy_currval[VERT_ATTRIB_WEIGHT];
+   exec->array.legacy_array[VERT_ATTRIB_WEIGHT] = &arrayObj->Weight;
    exec->array.legacy_array[VERT_ATTRIB_NORMAL] = &arrayObj->Normal;
    exec->array.legacy_array[VERT_ATTRIB_COLOR0] = &arrayObj->Color;
    exec->array.legacy_array[VERT_ATTRIB_COLOR1] = &arrayObj->SecondaryColor;
@@ -355,6 +355,14 @@ vbo_exec_DrawRangeElements(GLenum mode,
    if (!_mesa_validate_DrawRangeElements( ctx, mode, start, end, count, type, indices ))
       return;
 
+   if (end >= ctx->Array.ArrayObj->_MaxElement) {
+      /* the max element is out of bounds of one or more enabled arrays */
+      _mesa_warning(ctx, "glDraw[Range]Elements() index=%u is "
+                    "out of bounds (max=%u)", end,
+                    ctx->Array.ArrayObj->_MaxElement);
+      return;
+   }
+
    FLUSH_CURRENT( ctx, 0 );
 
    if (ctx->NewState)