fix bad array indexing in _save_current_init() that caused context state to get clobbered

1 files changed, 5 insertions, 4 deletions

diff --git a/src/mesa/tnl/t_save_api.c b/src/mesa/tnl/t_save_api.c
index 3236e14e421..4e85935932f 100644
--- a/src/mesa/tnl/t_save_api.c
+++ b/src/mesa/tnl/t_save_api.c
@@ -444,7 +444,6 @@ static void _save_upgrade_vertex( GLcontext *ctx,
       tnl->save.counter = ctx->Const.MaxArrayLockSize;
    tnl->save.initial_counter = tnl->save.counter;
 
-
    /* Recalculate all the attrptr[] values:
     */
    for (i = 0, tmp = tnl->save.vertex ; i < _TNL_ATTRIB_MAX ; i++) {
@@ -460,7 +459,6 @@ static void _save_upgrade_vertex( GLcontext *ctx,
     */
    _save_copy_from_current( ctx );
 
-
    /* Replay stored vertices to translate them to new format here.
     *
     * If there are copied vertices and the new (upgraded) attribute
@@ -1534,13 +1532,16 @@ static void _save_current_init( GLcontext *ctx )
    GLint i;
 
    for (i = 0; i < _TNL_ATTRIB_MAT_FRONT_AMBIENT; i++) {
+      ASSERT(i < VERT_ATTRIB_MAX);
       tnl->save.currentsz[i] = &ctx->ListState.ActiveAttribSize[i];
       tnl->save.current[i] = ctx->ListState.CurrentAttrib[i];
    }
 
    for (i = _TNL_ATTRIB_MAT_FRONT_AMBIENT; i < _TNL_ATTRIB_INDEX; i++) {
-      tnl->save.currentsz[i] = &ctx->ListState.ActiveMaterialSize[i];
-      tnl->save.current[i] = ctx->ListState.CurrentMaterial[i];
+      const GLuint j = i - _TNL_ATTRIB_MAT_FRONT_AMBIENT;
+      ASSERT(j < MAT_ATTRIB_MAX);
+      tnl->save.currentsz[i] = &ctx->ListState.ActiveMaterialSize[j];
+      tnl->save.current[i] = ctx->ListState.CurrentMaterial[j];
    }
 
    tnl->save.currentsz[_TNL_ATTRIB_INDEX] = &ctx->ListState.ActiveIndex;