auxiliary: fix util_framebuffer_copy

util_framebuffer_copy was attempting to copy all elements of the
source framebuffer state.

However, this breaks if the user does not zero initialize the structure.
Instead, only copy the elements up to nr_cbufs, and clear elements up
to dst->nr_cbufs, if the destination was larger than the source.

1 files changed, 4 insertions, 2 deletions

diff --git a/src/gallium/auxiliary/util/u_framebuffer.c b/src/gallium/auxiliary/util/u_framebuffer.c
index 768ae9ceb5d..7803ec6a8b5 100644
--- a/src/gallium/auxiliary/util/u_framebuffer.c
+++ b/src/gallium/auxiliary/util/u_framebuffer.c
@@ -85,9 +85,11 @@ util_copy_framebuffer_state(struct pipe_framebuffer_state *dst,
    dst->width = src->width;
    dst->height = src->height;
 
-   for (i = 0; i < Elements(src->cbufs); i++) {
+   for (i = 0; i < src->nr_cbufs; i++)
       pipe_surface_reference(&dst->cbufs[i], src->cbufs[i]);
-   }
+
+   for (i = src->nr_cbufs; i < dst->nr_cbufs; i++)
+      pipe_surface_reference(&dst->cbufs[i], NULL);
 
    dst->nr_cbufs = src->nr_cbufs;