OpenHarmony/third_party_mesa3d
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mesa: fix out of bounds access in glGetFramebufferParameterivEXT

Browse Source 
ColorDrawBuffer is an array of MAX_DRAW_BUFFERS == 8.

Found by Coverity.

Signed-off-by: Marcin Ślusarz <marcin.slusarz@intel.com>
Fixes: 7534c536ca ("mesa: add EXT_dsa (Named)Framebuffer functions")
Reviewed-by: Marek Olšák <marek.olsak@amd.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/6067>
This commit is contained in:
Marcin Ślusarz
2020-07-24 19:19:07 +02:00
committed by Marge Bot
parent 28f2585365
commit 0906d5d504
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/mesa/main/fbobject.c
View File

@@ -4814,7 +4814,11 @@ _mesa_GetFramebufferParameterivEXT(GLuint framebuffer, GLenum pname,
*param = fb->ColorReadBuffer; *param = fb->ColorReadBuffer;
} }
else if (GL_DRAW_BUFFER0 <= pname && pname <= GL_DRAW_BUFFER15) { else if (GL_DRAW_BUFFER0 <= pname && pname <= GL_DRAW_BUFFER15) {
*param = fb->ColorDrawBuffer[pname - GL_DRAW_BUFFER0]; unsigned buffer = pname - GL_DRAW_BUFFER0;
if (buffer < ARRAY_SIZE(fb->ColorDrawBuffer))
*param = fb->ColorDrawBuffer[buffer];
else
_mesa_error(ctx, GL_INVALID_ENUM, "glGetFramebufferParameterivEXT(pname)");
} }
else { else {
_mesa_error(ctx, GL_INVALID_ENUM, "glGetFramebufferParameterivEXT(pname)"); _mesa_error(ctx, GL_INVALID_ENUM, "glGetFramebufferParameterivEXT(pname)");