draw: Prevent out-of-bounds vertex buffer access.

Based on some code and ideas from Keith Whitwell.

1 files changed, 8 insertions, 0 deletions

diff --git a/src/gallium/auxiliary/draw/draw_private.h b/src/gallium/auxiliary/draw/draw_private.h
index db2e3c5410d..b7d693f8584 100644
--- a/src/gallium/auxiliary/draw/draw_private.h
+++ b/src/gallium/auxiliary/draw/draw_private.h
@@ -146,6 +146,14 @@ struct draw_context
       struct pipe_vertex_buffer vertex_buffer[PIPE_MAX_ATTRIBS];
       unsigned nr_vertex_buffers;
 
+      /*
+       * This is the largest legal index value for the current set of
+       * bound vertex buffers.  Regardless of any other consideration,
+       * all vertex lookups need to be clamped to 0..max_index to
+       * prevent out-of-bound access.
+       */
+      unsigned max_index;
+
       struct pipe_vertex_element vertex_element[PIPE_MAX_ATTRIBS];
       unsigned nr_vertex_elements;