diff options
| author | Ilia Mirkin <[email protected]> | 2014-01-22 21:30:07 -0500 |
|---|---|---|
| committer | Maarten Lankhorst <[email protected]> | 2014-01-27 16:40:42 +0100 |
| commit | 45b64e52f4df49ac01ac100fba2c01633d492a6d (patch) | |
| tree | 6204625d68f8e6fcf16bfe308a8d98ef622de70e /src/gallium/auxiliary | |
| parent | 3de97ce9200e9fe96891e7e92ec83f0fc38d8693 (diff) | |
util/u_vbuf: correct map offset calculation for crazy offsets
When the min_index is very large (or very negative), the multipliation
can overflow 32 bits and result in an incorrect map pointer
modification.
Signed-off-by: Ilia Mirkin <[email protected]>
Reviewed-by: Marek Olšák <[email protected]>
Diffstat (limited to 'src/gallium/auxiliary')
| -rw-r--r-- | src/gallium/auxiliary/util/u_vbuf.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/gallium/auxiliary/util/u_vbuf.c b/src/gallium/auxiliary/util/u_vbuf.c index 52b360ed7aa..0c9c349e00e 100644 --- a/src/gallium/auxiliary/util/u_vbuf.c +++ b/src/gallium/auxiliary/util/u_vbuf.c @@ -370,7 +370,7 @@ u_vbuf_translate_buffers(struct u_vbuf *mgr, struct translate_key *key, /* Subtract min_index so that indexing with the index buffer works. */ if (unroll_indices) { - map -= vb->stride * min_index; + map -= (ptrdiff_t)vb->stride * min_index; } tr->set_buffer(tr, i, map, vb->stride, ~0); |