From: Maarten Maathuis <madman2003@gmail.com>
Date: Wed, 13 Feb 2008 21:57:09 +0000 (+0100)
Subject: nv40: Avoid a nasty array overflow leading to a corrupt memory pointer.
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=2effa9b36cc47ca3fc0acc21908f5bb132eca3e7;p=mesa.git

nv40: Avoid a nasty array overflow leading to a corrupt memory pointer.
---

diff --git a/src/mesa/pipe/nv40/nv40_fragprog.c b/src/mesa/pipe/nv40/nv40_fragprog.c
index 714634396d2..14897f97982 100644
--- a/src/mesa/pipe/nv40/nv40_fragprog.c
+++ b/src/mesa/pipe/nv40/nv40_fragprog.c
@@ -716,7 +716,7 @@ nv40_fragprog_translate(struct nv40_context *nv40,
 			assert(imm->Immediate.DataType == TGSI_IMM_FLOAT32);
 			assert(fpc->nr_imm < MAX_IMM);
 
-			for (i = 0; i < imm->Immediate.Size; i++)
+			for (i = 0; i < (imm->Immediate.Size - 1); i++)
 				vals[i] = imm->u.ImmediateFloat32[i].Float;
 			fpc->imm[fpc->nr_imm++] = constant(fpc, -1, vals);
 		}