From: Anuj Phogat <anuj.phogat@gmail.com>
Date: Thu, 18 Sep 2014 23:30:31 +0000 (-0700)
Subject: glsl: Fix crash due to negative array index
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=6f0089e92e9a3b096b978bb09a87db6a38acb7b2;p=mesa.git

glsl: Fix crash due to negative array index

Currently Mesa crashes with a shader like this:

[fragmnet shader]
float[5] array;
int idx = -2;
void main()
{
   gl_FragColor = vec4(0.0, 1.0, 0.0, array[idx]);
}

Cc: <mesa-stable@lists.freedesktop.org>
Signed-off-by: Anuj Phogat <anuj.phogat@gmail.com>
Reviewed-by: Chris Forbes <chrisf@ijw.co.nz>
---

diff --git a/src/glsl/opt_array_splitting.cpp b/src/glsl/opt_array_splitting.cpp
index ebb076b223e..9e73f3c44bb 100644
--- a/src/glsl/opt_array_splitting.cpp
+++ b/src/glsl/opt_array_splitting.cpp
@@ -295,7 +295,7 @@ ir_array_splitting_visitor::split_deref(ir_dereference **deref)
    ir_constant *constant = deref_array->array_index->as_constant();
    assert(constant);
 
-   if (constant->value.i[0] < (int)entry->size) {
+   if (constant->value.i[0] >= 0 && constant->value.i[0] < (int)entry->size) {
       *deref = new(entry->mem_ctx)
 	 ir_dereference_variable(entry->components[constant->value.i[0]]);
    } else {