From 22a374fc3fdf97a9cc50e9fdc24049c997e6896e Mon Sep 17 00:00:00 2001
From: Brian <brian.paul@tungstengraphics.com>
Date: Mon, 19 Nov 2007 09:55:17 -0700
Subject: [PATCH] fix out-of-bounds array index (ix=-1)

---
 src/mesa/swrast/s_aatritemp.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/mesa/swrast/s_aatritemp.h b/src/mesa/swrast/s_aatritemp.h
index 42d74a16328..29609add179 100644
--- a/src/mesa/swrast/s_aatritemp.h
+++ b/src/mesa/swrast/s_aatritemp.h
@@ -1,6 +1,6 @@
 /*
  * Mesa 3-D graphics library
- * Version:  6.5.3
+ * Version:  7.0.3
  *
  * Copyright (C) 1999-2007  Brian Paul   All Rights Reserved.
  *
@@ -286,7 +286,7 @@
          }
 
          /* skip fragments with zero coverage */
-         while (startX >= 0) {
+         while (startX > 0) {
             coverage = compute_coveragef(pMin, pMax, pMid, startX, iy);
             if (coverage > 0.0F)
                break;
@@ -300,6 +300,7 @@
             /* (cx,cy) = center of fragment */
             const GLfloat cx = ix + 0.5F, cy = iy + 0.5F;
             SWspanarrays *array = span.array;
+            ASSERT(ix >= 0);
 #ifdef DO_INDEX
             array->coverage[ix] = (GLfloat) compute_coveragei(pMin, pMax, pMid, ix, iy);
 #else
-- 
2.30.2