vbo: check array indexes to prevent negative indexing

See the piglit dlist-fdo31590.c test

NOTE: This is a candidate for the 7.10 branch.

1 files changed, 8 insertions, 4 deletions

diff --git a/src/mesa/vbo/vbo_exec_api.c b/src/mesa/vbo/vbo_exec_api.c
index 3c7c439b64c..2b8d38ef283 100644
--- a/src/mesa/vbo/vbo_exec_api.c
+++ b/src/mesa/vbo/vbo_exec_api.c
@@ -608,11 +608,15 @@ static void GLAPIENTRY vbo_exec_End( void )
 
    if (ctx->Driver.CurrentExecPrimitive != PRIM_OUTSIDE_BEGIN_END) {
       struct vbo_exec_context *exec = &vbo_context(ctx)->exec;
-      int idx = exec->vtx.vert_count;
-      int i = exec->vtx.prim_count - 1;
 
-      exec->vtx.prim[i].end = 1; 
-      exec->vtx.prim[i].count = idx - exec->vtx.prim[i].start;
+      if (exec->vtx.prim_count > 0) {
+         /* close off current primitive */
+         int idx = exec->vtx.vert_count;
+         int i = exec->vtx.prim_count - 1;
+
+         exec->vtx.prim[i].end = 1; 
+         exec->vtx.prim[i].count = idx - exec->vtx.prim[i].start;
+      }
 
       ctx->Driver.CurrentExecPrimitive = PRIM_OUTSIDE_BEGIN_END;