summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorNicolai Hähnle <nicolai.haehnle@amd.com>2017-02-22 18:06:46 +0100
committerNicolai Hähnle <nicolai.haehnle@amd.com>2017-03-22 12:12:11 +0100
commitc2dfff280ba7d0857e350581496daa17cccacb84 (patch)
tree80caf41ded73ad947cac1321c847b64879b39263 /src
parentbd6f0dcafce73b1c7332a1c51f6862470fe2c2a0 (diff)
mesa: Avoid out-of-bounds stack read via _mesa_Materiali
MATERIALFV may end up reading up to 4 floats from the passed parameter. This should really set a GL_INVALID_ENUM error in the cases where it matters, but does anybody really care? Found by ASAN in piglit gl-1.0-beginend-coverage. v2: fix a trivial compiler warning Reviewed-by: Marek Olšák <marek.olsak@amd.com> (v1) Reviewed-by: Ian Romanick <ian.d.romanick@intel.com> (v1)
Diffstat (limited to 'src')
-rw-r--r--src/mesa/main/api_loopback.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/src/mesa/main/api_loopback.c b/src/mesa/main/api_loopback.c
index 8b63d9c0e95..59b59d3a9ec 100644
--- a/src/mesa/main/api_loopback.c
+++ b/src/mesa/main/api_loopback.c
@@ -865,8 +865,9 @@ _mesa_Materialf( GLenum face, GLenum pname, GLfloat param )
void GLAPIENTRY
_mesa_Materiali(GLenum face, GLenum pname, GLint param )
{
- GLfloat p = (GLfloat) param;
- MATERIALFV(face, pname, &p);
+ GLfloat p[4];
+ p[0] = (GLfloat) param;
+ MATERIALFV(face, pname, p);
}
void GLAPIENTRY