From a75e704326986b85539b6abf2319701e1a3138e9 Mon Sep 17 00:00:00 2001 From: Kenneth Graunke Date: Fri, 8 Jun 2012 22:12:23 -0700 Subject: [PATCH] mesa: Check for a negative "size" parameter in glCopyBufferSubData(). From the GL_ARB_copy_buffer spec: "An INVALID_VALUE error is generated if any of readoffset, writeoffset, or size are negative [...]" Fixes oglconform's copybuffer/negative.CNNegativeValues test. NOTE: This is a candidate for stable release branches. Signed-off-by: Kenneth Graunke Reviewed-by: Brian Paul Reviewed-by: Ian Romanick --- src/mesa/main/bufferobj.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/mesa/main/bufferobj.c b/src/mesa/main/bufferobj.c index 54156650974..846260d80fe 100644 --- a/src/mesa/main/bufferobj.c +++ b/src/mesa/main/bufferobj.c @@ -1360,6 +1360,12 @@ _mesa_CopyBufferSubData(GLenum readTarget, GLenum writeTarget, return; } + if (size < 0) { + _mesa_error(ctx, GL_INVALID_VALUE, + "glCopyBufferSubData(writeOffset = %d)", (int) size); + return; + } + if (readOffset + size > src->Size) { _mesa_error(ctx, GL_INVALID_VALUE, "glCopyBufferSubData(readOffset + size = %d)", -- 2.30.2