diff options
| author | Tapani Pälli <[email protected]> | 2019-02-14 09:02:31 +0200 |
|---|---|---|
| committer | Tapani Pälli <[email protected]> | 2019-02-18 07:51:55 +0200 |
| commit | 9762a9f89380a8070654a80e73d927297c29da35 (patch) | |
| tree | 3de9b39ba9e8b92d98442ff84aaf58bdacb2ea09 | |
| parent | 2c6a7fbeb78856d6405e1c0dff17a58478b0019e (diff) | |
mesa: return NULL if we exceed MaxColorAttachments in get_fb_attachment
This fixes invalid access to Attachment array which would occur if caller
would exceed MaxColorAttachments. In practice this should not ever happen
because DiscardFramebufferEXT specifies only GL_COLOR_ATTACHMENT0 to be
valid and InvalidateFramebuffer will error out before but this should
make coverity happy.
v2: const, remove _EXT (Ian)
CID: 1442559
Fixes: 0c42b5f3cb9 "mesa: wire up InvalidateFramebuffer"
Signed-off-by: Tapani Pälli <[email protected]>
Reviewed-by: Ian Romanick <[email protected]>
| -rw-r--r-- | src/mesa/main/fbobject.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/mesa/main/fbobject.c b/src/mesa/main/fbobject.c index 87c33be7854..341fd93efc6 100644 --- a/src/mesa/main/fbobject.c +++ b/src/mesa/main/fbobject.c @@ -4663,8 +4663,12 @@ get_fb_attachment(struct gl_context *ctx, struct gl_framebuffer *fb, case GL_COLOR_ATTACHMENT12: case GL_COLOR_ATTACHMENT13: case GL_COLOR_ATTACHMENT14: - case GL_COLOR_ATTACHMENT15: - return &fb->Attachment[BUFFER_COLOR0 + attachment - GL_COLOR_ATTACHMENT0]; + case GL_COLOR_ATTACHMENT15: { + const unsigned i = attachment - GL_COLOR_ATTACHMENT0; + if (i >= ctx->Const.MaxColorAttachments) + return NULL; + return &fb->Attachment[BUFFER_COLOR0 + i]; + } case GL_DEPTH: case GL_DEPTH_ATTACHMENT: case GL_DEPTH_STENCIL_ATTACHMENT: |