mesa/st: Prevent 'end' < 'start' in vbo_exec_DrawRangeElementsBaseVertex()

We adjust 'end' to fit into _MaxElement, but that may result into a 'start'
value bigger than 'end' being passed downstream, causing havoc.

This could be seen with arb_robustness_draw-vbo-bounds, due to an
application bug.

diff --git a/src/mesa/vbo/vbo_exec_array.c b/src/mesa/vbo/vbo_exec_array.c
index 98d6badc47a2f4e5994c120304196a5da7b936db..6e26e4e77a0de5f7945d93cb6ca429e911cf00da 100644 (file)
--- a/src/mesa/vbo/vbo_exec_array.c
+++ b/src/mesa/vbo/vbo_exec_array.c
@@ -943,8 +943,13 @@ vbo_exec_DrawRangeElementsBaseVertex(GLenum mode,
       /* Set 'end' to the max possible legal value */
       assert(ctx->Array.ArrayObj->_MaxElement >= 1);
       end = ctx->Array.ArrayObj->_MaxElement - 1;
+
+      if (end < start) {
+         return;
+      }
    }
-   else if (0) {
+
+   if (0) {
       printf("glDraw[Range]Elements{,BaseVertex}"
             "(start %u, end %u, type 0x%x, count %d) ElemBuf %u, "
             "base %d\n",