mesa: fix NULL pointer deref bug in _mesa_drawbuffers()

This is a follow-on fix to commit 39b40ad144.  Fixes a crash if the
user calls glDrawBuffers(0, NULL).

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=82814
Cc: "10.2" <mesa-stable@lists.freedesktop.org>
Reviewed-by: Roland Scheidegger <sroland@vmware.com>

diff --git a/src/mesa/main/buffers.c b/src/mesa/main/buffers.c
index 140cf6e82eb9c2bcf9b8ef012b3c600072af854c..8a0852c429c20d828a4128be344db3dabaa70783 100644 (file)
--- a/src/mesa/main/buffers.c
+++ b/src/mesa/main/buffers.c
@@ -498,7 +498,7 @@ _mesa_drawbuffers(struct gl_context *ctx, GLuint n, const GLenum *buffers,
     * (ex: glDrawBuffer(GL_FRONT_AND_BACK)).
     * Otherwise, destMask[x] can only have one bit set.
     */
-   if (_mesa_bitcount(destMask[0]) > 1) {
+   if (n > 0 && _mesa_bitcount(destMask[0]) > 1) {
       GLuint count = 0, destMask0 = destMask[0];
       while (destMask0) {
          GLint bufIndex = ffs(destMask0) - 1;