From: Brian Paul <brianp@vmware.com>
Date: Tue, 19 Aug 2014 13:51:07 +0000 (-0600)
Subject: mesa: fix NULL pointer deref bug in _mesa_drawbuffers()
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=31ce84a81f7166ded07e9cb41e5dfe212dd8fed1;p=mesa.git

mesa: fix NULL pointer deref bug in _mesa_drawbuffers()

This is a follow-on fix to commit 39b40ad144.  Fixes a crash if the
user calls glDrawBuffers(0, NULL).

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=82814
Cc: "10.2" <mesa-stable@lists.freedesktop.org>
Reviewed-by: Roland Scheidegger <sroland@vmware.com>
---

diff --git a/src/mesa/main/buffers.c b/src/mesa/main/buffers.c
index 140cf6e82eb..8a0852c429c 100644
--- a/src/mesa/main/buffers.c
+++ b/src/mesa/main/buffers.c
@@ -498,7 +498,7 @@ _mesa_drawbuffers(struct gl_context *ctx, GLuint n, const GLenum *buffers,
     * (ex: glDrawBuffer(GL_FRONT_AND_BACK)).
     * Otherwise, destMask[x] can only have one bit set.
     */
-   if (_mesa_bitcount(destMask[0]) > 1) {
+   if (n > 0 && _mesa_bitcount(destMask[0]) > 1) {
       GLuint count = 0, destMask0 = destMask[0];
       while (destMask0) {
          GLint bufIndex = ffs(destMask0) - 1;