diff options
| author | Brian Paul <[email protected]> | 2008-11-10 14:27:42 -0700 |
|---|---|---|
| committer | Brian Paul <[email protected]> | 2008-11-10 14:27:42 -0700 |
| commit | 13f96c5401ffe3869f08fecb2baf5bff2438b02e (patch) | |
| tree | a7b3e9c73b980cb9cb744d656c918eea69a3f66b /src/mesa/main/enums.c | |
| parent | 6186e7a20676c5df30b1b4bffeec87afa1550e25 (diff) | |
GLX: fix out-of-bounds memory issue in indirect glAreTexturesResident()
See bug 18445.
When getting array results, __glXReadReply() always reads a multiple of
four bytes. This can cause writing to invalid memory when 'n' is not a
multiple of four.
Special-case the glAreTexturesResident() functions now.
To fix the bug, we use a temporary buffer that's a multiple of four bytes
in length.
NOTE: this commit also reverts part of commit 919ec22ecf72aa163e1b97d8c7381002131ed32c
(glx/x11: Added some #ifdef GLX_DIRECT_RENDERING protection) which
directly edited the indirect.c file rather than the python generator!
I'm not repairing that issue at this time.
Diffstat (limited to 'src/mesa/main/enums.c')
| -rw-r--r-- | src/mesa/main/enums.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/mesa/main/enums.c b/src/mesa/main/enums.c index 15e7d5b96ce..a9c102e4f2d 100644 --- a/src/mesa/main/enums.c +++ b/src/mesa/main/enums.c @@ -4866,8 +4866,8 @@ const char *_mesa_lookup_enum_by_nr( int nr ) { unsigned * i; - i = (unsigned *)_mesa_bsearch( & nr, reduced_enums, Elements(reduced_enums), - sizeof(reduced_enums[0]), (cfunc) compar_nr ); + i = (unsigned *)bsearch( & nr, reduced_enums, Elements(reduced_enums), + sizeof(reduced_enums[0]), (cfunc) compar_nr ); if ( i != NULL ) { return & enum_string_table[ all_enums[ *i ].offset ]; @@ -4884,8 +4884,8 @@ int _mesa_lookup_enum_by_name( const char *symbol ) enum_elt * f = NULL; if ( symbol != NULL ) { - f = (enum_elt *)_mesa_bsearch( symbol, all_enums, Elements(all_enums), - sizeof( enum_elt ), (cfunc) compar_name ); + f = (enum_elt *)bsearch( symbol, all_enums, Elements(all_enums), + sizeof( enum_elt ), (cfunc) compar_name ); } return (f != NULL) ? f->n : -1; |