From: Kenneth Graunke <kenneth@whitecape.org>
Date: Tue, 26 Apr 2016 05:34:37 +0000 (-0700)
Subject: mesa: Fix indirect draw buffer size check on 32-bit systems.
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=2655265fcba9017e793026c76e490e04db088c8f;p=mesa.git

mesa: Fix indirect draw buffer size check on 32-bit systems.

Fixes dEQP-GLES31.functional subtests:
draw_indirect.negative.command_offset_not_in_buffer_signed32_wrap
draw_indirect.negative.command_offset_not_in_buffer_unsigned32_wrap

These tests use really large values that overflow GLsizeiptr, at
which point the buffer size isn't less than "end".

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=95138
Signed-off-by: Kenneth Graunke <kenneth@whitecape.org>
Reviewed-by: Alejandro Piñeiro <apinheiro@igalia.com>
Reviewed-by: Mark Janes <mark.a.janes@intel.com>
---

diff --git a/src/mesa/main/api_validate.c b/src/mesa/main/api_validate.c
index 2b629977644..688408f8dee 100644
--- a/src/mesa/main/api_validate.c
+++ b/src/mesa/main/api_validate.c
@@ -696,7 +696,7 @@ valid_draw_indirect(struct gl_context *ctx,
                     GLenum mode, const GLvoid *indirect,
                     GLsizei size, const char *name)
 {
-   const GLsizeiptr end = (GLsizeiptr)indirect + size;
+   const uint64_t end = (uint64_t) (uintptr_t) indirect + size;
 
    /* OpenGL ES 3.1 spec. section 10.5:
     *