From: Ilia Mirkin <imirkin@alum.mit.edu>
Date: Thu, 23 Jan 2014 02:30:07 +0000 (-0500)
Subject: util/u_vbuf: correct map offset calculation for crazy offsets
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=45b64e52f4df49ac01ac100fba2c01633d492a6d;p=mesa.git

util/u_vbuf: correct map offset calculation for crazy offsets

When the min_index is very large (or very negative), the multipliation
can overflow 32 bits and result in an incorrect map pointer
modification.

Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Reviewed-by: Marek Olšák <marek.olsak@amd.com>
---

diff --git a/src/gallium/auxiliary/util/u_vbuf.c b/src/gallium/auxiliary/util/u_vbuf.c
index 52b360ed7aa..0c9c349e00e 100644
--- a/src/gallium/auxiliary/util/u_vbuf.c
+++ b/src/gallium/auxiliary/util/u_vbuf.c
@@ -370,7 +370,7 @@ u_vbuf_translate_buffers(struct u_vbuf *mgr, struct translate_key *key,
 
       /* Subtract min_index so that indexing with the index buffer works. */
       if (unroll_indices) {
-         map -= vb->stride * min_index;
+         map -= (ptrdiff_t)vb->stride * min_index;
       }
 
       tr->set_buffer(tr, i, map, vb->stride, ~0);