vbo: fix array index out of bounds error, and fix evaluator priorities

Fixes bug 25525.
Plus, the GL_NV_vertex_program evaluators alias and override the
convential evaluator maps, so set their state after the conventional
maps.

1 files changed, 21 insertions, 12 deletions

diff --git a/src/mesa/vbo/vbo_exec_eval.c b/src/mesa/vbo/vbo_exec_eval.c
index 0c691b3a5cd..a7846213d0c 100644
--- a/src/mesa/vbo/vbo_exec_eval.c
+++ b/src/mesa/vbo/vbo_exec_eval.c
@@ -35,17 +35,20 @@
 
 static void clear_active_eval1( struct vbo_exec_context *exec, GLuint attr ) 
 {
+   assert(attr < Elements(exec->eval.map1));
    exec->eval.map1[attr].map = NULL;
 }
 
 static void clear_active_eval2( struct vbo_exec_context *exec, GLuint attr ) 
 {
+   assert(attr < Elements(exec->eval.map2));
    exec->eval.map2[attr].map = NULL;
 }
 
 static void set_active_eval1( struct vbo_exec_context *exec, GLuint attr, GLuint dim, 
 			      struct gl_1d_map *map )
 {
+   assert(attr < Elements(exec->eval.map1));
    if (!exec->eval.map1[attr].map) {
       exec->eval.map1[attr].map = map;
       exec->eval.map1[attr].sz = dim;
@@ -55,6 +58,7 @@ static void set_active_eval1( struct vbo_exec_context *exec, GLuint attr, GLuint
 static void set_active_eval2( struct vbo_exec_context *exec, GLuint attr, GLuint dim, 
 			      struct gl_2d_map *map )
 {
+   assert(attr < Elements(exec->eval.map2));
    if (!exec->eval.map2[attr].map) {
       exec->eval.map2[attr].map = map;
       exec->eval.map2[attr].sz = dim;
@@ -73,18 +77,6 @@ void vbo_exec_eval_update( struct vbo_exec_context *exec )
       clear_active_eval2( exec, attr );
    }
 
-   /* _NEW_PROGRAM */
-   if (ctx->VertexProgram._Enabled) {
-      for (attr = 0; attr < VBO_ATTRIB_FIRST_MATERIAL; attr++) {
-	 /* _NEW_EVAL */
-	 if (ctx->Eval.Map1Attrib[attr]) 
-	    set_active_eval1( exec, attr, 4, &ctx->EvalMap.Map1Attrib[attr] );
-
-	 if (ctx->Eval.Map2Attrib[attr]) 
-	    set_active_eval2( exec, attr, 4, &ctx->EvalMap.Map2Attrib[attr] );
-      }
-   }
-
    if (ctx->Eval.Map1Color4) 
       set_active_eval1( exec, VBO_ATTRIB_COLOR0, 4, &ctx->EvalMap.Map1Color4 );
       
@@ -125,6 +117,23 @@ void vbo_exec_eval_update( struct vbo_exec_context *exec )
    else if (ctx->Eval.Map2Vertex3) 
       set_active_eval2( exec, VBO_ATTRIB_POS, 3, &ctx->EvalMap.Map2Vertex3 );
 
+   /* _NEW_PROGRAM */
+   if (ctx->VertexProgram._Enabled) {
+      /* These are the 16 evaluators which GL_NV_vertex_program defines.
+       * They alias and override the conventional vertex attributs.
+       */
+      for (attr = 0; attr < 16; attr++) {
+         /* _NEW_EVAL */
+         assert(attr < Elements(ctx->Eval.Map1Attrib));
+         if (ctx->Eval.Map1Attrib[attr]) 
+            set_active_eval1( exec, attr, 4, &ctx->EvalMap.Map1Attrib[attr] );
+
+         assert(attr < Elements(ctx->Eval.Map2Attrib));
+         if (ctx->Eval.Map2Attrib[attr]) 
+            set_active_eval2( exec, attr, 4, &ctx->EvalMap.Map2Attrib[attr] );
+      }
+   }
+
    exec->eval.recalculate_maps = 0;
 }