Fix bug 1858 - array subscript out of range in gamma driver.

Set ctx->Const.MaxTextureLevels = GAMMA_TEX_MAXLEVELS = 12
Remove bogus WRITE(level 12).
Max gamma texture size is 2kx2k  (note: 2k = 1 << (MaxLevels - 1))

3 files changed, 2 insertions, 3 deletions

diff --git a/src/mesa/drivers/dri/gamma/gamma_context.c b/src/mesa/drivers/dri/gamma/gamma_context.c
index f0d16db8ad7..ffaf45459bc 100644
--- a/src/mesa/drivers/dri/gamma/gamma_context.c
+++ b/src/mesa/drivers/dri/gamma/gamma_context.c
@@ -115,7 +115,7 @@ GLboolean gammaCreateContext( const __GLcontextModes *glVisual,
 
    ctx = gmesa->glCtx;
 
-   ctx->Const.MaxTextureLevels = 13;  /* 4K by 4K?  Is that right? */
+   ctx->Const.MaxTextureLevels = GAMMA_TEX_MAXLEVELS;
    ctx->Const.MaxTextureUnits = 1; /* Permedia 3 */
    ctx->Const.MaxTextureImageUnits = 1;
    ctx->Const.MaxTextureCoordUnits = 1;
diff --git a/src/mesa/drivers/dri/gamma/gamma_context.h b/src/mesa/drivers/dri/gamma/gamma_context.h
index 6dd458bc95c..7745f4c3c3d 100644
--- a/src/mesa/drivers/dri/gamma/gamma_context.h
+++ b/src/mesa/drivers/dri/gamma/gamma_context.h
@@ -118,7 +118,7 @@ typedef struct gamma_texture_object_t *gammaTextureObjectPtr;
 
 #define VALID_GAMMA_TEXTURE_OBJECT(tobj)  (tobj) 
 
-#define GAMMA_TEX_MAXLEVELS 12
+#define GAMMA_TEX_MAXLEVELS 12  /* 2K x 2K */
 
 /* For shared texture space managment, these texture objects may also
  * be used as proxies for regions of texture memory containing other
diff --git a/src/mesa/drivers/dri/gamma/gamma_state.c b/src/mesa/drivers/dri/gamma/gamma_state.c
index 24a6b3672c7..194313dc975 100644
--- a/src/mesa/drivers/dri/gamma/gamma_state.c
+++ b/src/mesa/drivers/dri/gamma/gamma_state.c
@@ -1593,7 +1593,6 @@ void gammaEmitHwState( gammaContextPtr gmesa )
 	WRITE(gmesa->buf, TxBaseAddr9, curTex->TextureBaseAddr[9]);
 	WRITE(gmesa->buf, TxBaseAddr10, curTex->TextureBaseAddr[10]);
 	WRITE(gmesa->buf, TxBaseAddr11, curTex->TextureBaseAddr[11]);
-	WRITE(gmesa->buf, TxBaseAddr12, curTex->TextureBaseAddr[12]);
 	WRITE(gmesa->buf, TextureCacheControl, (TCC_Enable | TCC_Invalidate));
 	} else {
 	CHECK_DMA_BUFFER(gmesa, 6);