mesa: Fix array out-of-bounds access by _mesa_TexGenf.

_mesa_TexGenf calls _mesa_TexGenfv, which uses the params argument
as an array.

diff --git a/src/mesa/main/texgen.c b/src/mesa/main/texgen.c
index 087f66bbf35eb2f79dc3b8558c5abcd59090eb76..5abb1ff0ab60a772448230e657b4b9d5c43317ff 100644 (file)
--- a/src/mesa/main/texgen.c
+++ b/src/mesa/main/texgen.c
@@ -211,7 +211,10 @@ _mesa_TexGendv(GLenum coord, GLenum pname, const GLdouble *params )
 static void GLAPIENTRY
 _mesa_TexGenf( GLenum coord, GLenum pname, GLfloat param )
 {
 static void GLAPIENTRY
 _mesa_TexGenf( GLenum coord, GLenum pname, GLfloat param )
 {

-   _mesa_TexGenfv(coord, pname, &param);
+   GLfloat p[4];
+   p[0] = param;
+   p[1] = p[2] = p[3] = 0.0F;
+   _mesa_TexGenfv(coord, pname, p);

 }
 
 
 }