diff options
| author | Nicolai Hähnle <[email protected]> | 2017-02-22 18:06:46 +0100 |
|---|---|---|
| committer | Nicolai Hähnle <[email protected]> | 2017-03-22 12:12:11 +0100 |
| commit | c2dfff280ba7d0857e350581496daa17cccacb84 (patch) | |
| tree | 80caf41ded73ad947cac1321c847b64879b39263 | |
| parent | bd6f0dcafce73b1c7332a1c51f6862470fe2c2a0 (diff) | |
mesa: Avoid out-of-bounds stack read via _mesa_Materiali
MATERIALFV may end up reading up to 4 floats from the passed parameter.
This should really set a GL_INVALID_ENUM error in the cases where it
matters, but does anybody really care?
Found by ASAN in piglit gl-1.0-beginend-coverage.
v2: fix a trivial compiler warning
Reviewed-by: Marek Olšák <[email protected]> (v1)
Reviewed-by: Ian Romanick <[email protected]> (v1)
| -rw-r--r-- | src/mesa/main/api_loopback.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/mesa/main/api_loopback.c b/src/mesa/main/api_loopback.c index 8b63d9c0e95..59b59d3a9ec 100644 --- a/src/mesa/main/api_loopback.c +++ b/src/mesa/main/api_loopback.c @@ -865,8 +865,9 @@ _mesa_Materialf( GLenum face, GLenum pname, GLfloat param ) void GLAPIENTRY _mesa_Materiali(GLenum face, GLenum pname, GLint param ) { - GLfloat p = (GLfloat) param; - MATERIALFV(face, pname, &p); + GLfloat p[4]; + p[0] = (GLfloat) param; + MATERIALFV(face, pname, p); } void GLAPIENTRY |