mesa: Fix buffer overflow when parsing generic vertex attributes.
authorBrian Paul <brianp@vmware.com>
Wed, 22 Apr 2009 17:16:03 +0000 (18:16 +0100)
committerJosé Fonseca <jfonseca@vmware.com>
Wed, 22 Apr 2009 17:18:29 +0000 (18:18 +0100)
src/mesa/shader/arbprogparse.c

index b47bf360cf561d6ca0f4ef263992d039b4266c2a..c7a031067efe905b25275f694558387b90d9c480 100644 (file)
@@ -1513,10 +1513,16 @@ generic_attrib_check(struct var_cache *vc_head)
    curr = vc_head;
    while (curr) {
       if (curr->type == vt_attrib) {
-         if (curr->attrib_is_generic)
-            genericAttrib[ curr->attrib_binding ] = GL_TRUE;
-         else
+         if (curr->attrib_is_generic) {
+            GLuint attr = (curr->attrib_binding == 0)
+               ? 0 : (curr->attrib_binding - VERT_ATTRIB_GENERIC0);
+            assert(attr < MAX_VERTEX_PROGRAM_ATTRIBS);
+            genericAttrib[attr] = GL_TRUE;
+         }
+         else {
+            assert(curr->attrib_binding < MAX_VERTEX_PROGRAM_ATTRIBS);
             explicitAttrib[ curr->attrib_binding ] = GL_TRUE;
+         }
       }
 
       curr = curr->next;