diff options
| -rw-r--r-- | src/gallium/drivers/svga/svga_draw.c | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/src/gallium/drivers/svga/svga_draw.c b/src/gallium/drivers/svga/svga_draw.c index c43d1a3443f..41e0e1adc2f 100644 --- a/src/gallium/drivers/svga/svga_draw.c +++ b/src/gallium/drivers/svga/svga_draw.c @@ -310,12 +310,6 @@ enum pipe_error svga_hwtnl_prim( struct svga_hwtnl *hwtnl, assert(size); assert(offset < size); assert(min_index <= max_index); - if (index_bias >= 0) { - assert(offset + index_bias*stride < size); - } - if (min_index != ~0 && index_bias >= 0) { - assert(offset + (index_bias + min_index) * stride < size); - } switch (hwtnl->cmd.vdecl[i].identity.type) { case SVGA3D_DECLTYPE_FLOAT1: @@ -375,9 +369,14 @@ enum pipe_error svga_hwtnl_prim( struct svga_hwtnl *hwtnl, break; } - if (max_index != ~0) { - assert(offset + (index_bias + max_index) * stride + width <= size); + if (index_bias >= 0) { + assert(offset + index_bias*stride + width <= size); } + + /* + * min_index/max_index are merely conservative guesses, so we can't + * make buffer overflow detection based on their values. + */ } assert(range->indexWidth == range->indexArray.stride); |