mesa: Move transform feedback error check to reduce array overflow risk.

Previous to this patch, we didn't do the limit check for
MAX_TRANSFORM_FEEDBACK_INTERLEAVED_COMPONENTS until the end of the
store_tfeedback_info() function, *after* storing all of the transform
feedback info in the gl_transform_feedback_info::Outputs array.  This
meant that the limit check wouldn't prevent us from overflowing the
array and corrupting memory.

This patch moves the limit check to the top of tfeedback_decl::store()
so that there is no risk of overflowing the array.  It also adds
assertions to verify that the checks for
MAX_TRANSFORM_FEEDBACK_INTERLEAVED_COMPONENTS and
MAX_TRANSFORM_FEEDBACK_SEPARATE_COMPONENTS are sufficient to avoid
array overflow.

Note: strictly speaking this patch isn't necessary, since the maximum
possible number of varyings is MAX_VARYING (16), whereas the size of
the Outputs array is MAX_PROGRAM_OUTPUTS (64), so it's impossible to
have enough varyings to overflow the array.  However it seems prudent
to do the limit check before the array access in case these limits
change in the future.

Reviewed-by: Ian Romanick <[email protected]>

0 files changed, 0 insertions, 0 deletions