limit max program/param length to 255 (spotted by sroland)

diff --git a/src/mesa/drivers/dri/r300/r300_context.h b/src/mesa/drivers/dri/r300/r300_context.h
index 7504bd894ab9ff3e1d8b228bda0ea5f8cb984e38..58f789eeae744ef0db0ec6b6ddb952c19afaea41 100644 (file)
--- a/src/mesa/drivers/dri/r300/r300_context.h
+++ b/src/mesa/drivers/dri/r300/r300_context.h
@@ -549,7 +549,8 @@ struct r300_vap_reg_state {
 /* Vertex shader state */
 
 /* Perhaps more if we store programs in vmem? */
-#define VSF_MAX_FRAGMENT_LENGTH (256*4)
+/* drm_r300_cmd_header_t->vpu->count is unsigned char */
+#define VSF_MAX_FRAGMENT_LENGTH (255*4)
        
 /* Can be tested with colormat currently. */
 #define VSF_MAX_FRAGMENT_TEMPS (14)

diff --git a/src/mesa/drivers/dri/r300/r300_state.c b/src/mesa/drivers/dri/r300/r300_state.c
index 951b92595382cf1148bf7ede6ffe29d3eec07434..ae0d271521025fd32868037b8769a9d9308cd007 100644 (file)
--- a/src/mesa/drivers/dri/r300/r300_state.c
+++ b/src/mesa/drivers/dri/r300/r300_state.c
@@ -1403,6 +1403,7 @@ void r300_setup_rs_unit(GLcontext *ctx)
 #define bump_vpu_count(ptr, new_count)   do{\
        drm_r300_cmd_header_t* _p=((drm_r300_cmd_header_t*)(ptr));\
        int _nc=(new_count)/4; \
+       assert(_nc < 256); \
        if(_nc>_p->vpu.count)_p->vpu.count=_nc;\
        }while(0)