summaryrefslogtreecommitdiffstats
path: root/src/glsl/builtin_stubs.cpp
diff options
context:
space:
mode:
authorPaul Berry <[email protected]>2012-01-09 11:25:14 -0800
committerPaul Berry <[email protected]>2012-01-11 07:57:56 -0800
commitd3150ebc8c1833322daf24b2cd47e31a5b2f8a1f (patch)
tree795407db61389ccda0abbe58a1620bfff93c3ca2 /src/glsl/builtin_stubs.cpp
parent642e5b413e0890b2070ba78fde42db381eaf02e5 (diff)
mesa: Move transform feedback error check to reduce array overflow risk.
Previous to this patch, we didn't do the limit check for MAX_TRANSFORM_FEEDBACK_INTERLEAVED_COMPONENTS until the end of the store_tfeedback_info() function, *after* storing all of the transform feedback info in the gl_transform_feedback_info::Outputs array. This meant that the limit check wouldn't prevent us from overflowing the array and corrupting memory. This patch moves the limit check to the top of tfeedback_decl::store() so that there is no risk of overflowing the array. It also adds assertions to verify that the checks for MAX_TRANSFORM_FEEDBACK_INTERLEAVED_COMPONENTS and MAX_TRANSFORM_FEEDBACK_SEPARATE_COMPONENTS are sufficient to avoid array overflow. Note: strictly speaking this patch isn't necessary, since the maximum possible number of varyings is MAX_VARYING (16), whereas the size of the Outputs array is MAX_PROGRAM_OUTPUTS (64), so it's impossible to have enough varyings to overflow the array. However it seems prudent to do the limit check before the array access in case these limits change in the future. Reviewed-by: Ian Romanick <[email protected]>
Diffstat (limited to 'src/glsl/builtin_stubs.cpp')
0 files changed, 0 insertions, 0 deletions