vbo: if 'end' is out of bounds, clamp it

If we determine that the 'end' parameter to glDrawElements() is out of
bounds, clamp it to the max legal index value.

diff --git a/src/mesa/vbo/vbo_exec_array.c b/src/mesa/vbo/vbo_exec_array.c
index f4553825921cee12e504736676154c4088ed962e..bd2fccdba1456fb5a8b79f48d26cb8c9e5b84718 100644 (file)
--- a/src/mesa/vbo/vbo_exec_array.c
+++ b/src/mesa/vbo/vbo_exec_array.c
@@ -748,6 +748,10 @@ vbo_exec_DrawRangeElementsBaseVertex(GLenum mode,
           */
       }
 #endif
+
+      /* Set 'end' to the max possible legal value */
+      assert(ctx->Array.ArrayObj->_MaxElement >= 1);
+      end = ctx->Array.ArrayObj->_MaxElement - 1;
    }
    else if (0) {
       _mesa_printf("glDraw[Range]Elements{,BaseVertex}"