3 files changed, 12 insertions, 7 deletions
diff --git a/src/gallium/drivers/r300/r300_blit.c b/src/gallium/drivers/r300/r300_blit.c
index 2f9650df1b7..297768e5cf4 100644
--- a/src/gallium/drivers/r300/r300_blit.c
+++ b/src/gallium/drivers/r300/r300_blit.c
@@ -34,7 +34,7 @@ static void r300_blitter_save_states(struct r300_context* r300)
     util_blitter_save_rasterizer(r300->blitter, r300->rs_state.state);
     util_blitter_save_fragment_shader(r300->blitter, r300->fs);
     util_blitter_save_vertex_shader(r300->blitter, r300->vs);
-    util_blitter_save_vertex_elements(r300->blitter, r300->vs);
+    util_blitter_save_vertex_elements(r300->blitter, r300->velems);
 }
 
 /* Clear currently bound buffers. */
diff --git a/src/gallium/drivers/r300/r300_context.h b/src/gallium/drivers/r300/r300_context.h
index 0ee0ab47a6b..f372743c5b8 100644
--- a/src/gallium/drivers/r300/r300_context.h
+++ b/src/gallium/drivers/r300/r300_context.h
@@ -249,7 +249,7 @@ struct r300_vertex_info {
 
 struct r300_velems_state {
     unsigned count;
-    struct pipe_vertex_element velem[];
+    struct pipe_vertex_element velem[PIPE_MAX_ATTRIBS];
 };
 
 extern struct pipe_viewport_state r300_viewport_identity;
diff --git a/src/gallium/drivers/r300/r300_state.c b/src/gallium/drivers/r300/r300_state.c
index ceac690fc46..995664d9000 100644
--- a/src/gallium/drivers/r300/r300_state.c
+++ b/src/gallium/drivers/r300/r300_state.c
@@ -1061,13 +1061,14 @@ static void* r300_create_vertex_elements_state(struct pipe_context* pipe,
                                                unsigned count,
                                                const struct pipe_vertex_element* attribs)
 {
-   /*XXX could precalculate state here instead of later */
     struct r300_velems_state *velems;
+
+    /*XXX should precalculate state here instead of later */
     assert(count <= PIPE_MAX_ATTRIBS);
-    velems = (struct r300_velems_state *) MALLOC(sizeof(struct r300_velems_state) + count * sizeof(*attribs));
+    velems = CALLOC_STRUCT(r300_velems_state);
     if (velems) {
-       velems->count = count;
-       memcpy(velems->velem, attribs, sizeof(*attribs) * count);
+        velems->count = count;
+        memcpy(velems->velem, attribs, sizeof(struct pipe_vertex_element) * count);
     }
     return velems;
 }
@@ -1078,6 +1079,10 @@ static void r300_bind_vertex_elements_state(struct pipe_context *pipe,
     struct r300_context *r300 = r300_context(pipe);
     struct r300_velems_state *r300_velems = (struct r300_velems_state *) velems;
 
+    if (velems == NULL) {
+        return;
+    }
+
     r300->velems = r300_velems;
 
     if (r300->draw) {
@@ -1094,7 +1099,7 @@ static void r300_bind_vertex_elements_state(struct pipe_context *pipe,
 
 static void r300_delete_vertex_elements_state(struct pipe_context *pipe, void *velems)
 {
-   FREE( velems );
+   FREE(velems);
 }
 
 static void* r300_create_vs_state(struct pipe_context* pipe,