From 31ce84a81f7166ded07e9cb41e5dfe212dd8fed1 Mon Sep 17 00:00:00 2001 From: Brian Paul Date: Tue, 19 Aug 2014 07:51:07 -0600 Subject: [PATCH] mesa: fix NULL pointer deref bug in _mesa_drawbuffers() This is a follow-on fix to commit 39b40ad144. Fixes a crash if the user calls glDrawBuffers(0, NULL). Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=82814 Cc: "10.2" Reviewed-by: Roland Scheidegger --- src/mesa/main/buffers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/mesa/main/buffers.c b/src/mesa/main/buffers.c index 140cf6e82eb..8a0852c429c 100644 --- a/src/mesa/main/buffers.c +++ b/src/mesa/main/buffers.c @@ -498,7 +498,7 @@ _mesa_drawbuffers(struct gl_context *ctx, GLuint n, const GLenum *buffers, * (ex: glDrawBuffer(GL_FRONT_AND_BACK)). * Otherwise, destMask[x] can only have one bit set. */ - if (_mesa_bitcount(destMask[0]) > 1) { + if (n > 0 && _mesa_bitcount(destMask[0]) > 1) { GLuint count = 0, destMask0 = destMask[0]; while (destMask0) { GLint bufIndex = ffs(destMask0) - 1; -- 2.30.2