5 files changed, 13 insertions, 3 deletions
diff --git a/src/gallium/drivers/llvmpipe/lp_setup.h b/src/gallium/drivers/llvmpipe/lp_setup.h
index 1f55aa41c7f..712ed145d8e 100644
--- a/src/gallium/drivers/llvmpipe/lp_setup.h
+++ b/src/gallium/drivers/llvmpipe/lp_setup.h
@@ -154,4 +154,10 @@ void
 lp_setup_end_query(struct lp_setup_context *setup,
                    struct llvmpipe_query *pq);
 
+static INLINE unsigned
+lp_clamp_scissor_idx(int idx)
+{
+   return (PIPE_MAX_VIEWPORTS > idx && idx >= 0) ? idx : 0;
+}
+
 #endif
diff --git a/src/gallium/drivers/llvmpipe/lp_setup_line.c b/src/gallium/drivers/llvmpipe/lp_setup_line.c
index c2a069fe066..57a96d57ce7 100644
--- a/src/gallium/drivers/llvmpipe/lp_setup_line.c
+++ b/src/gallium/drivers/llvmpipe/lp_setup_line.c
@@ -318,7 +318,7 @@ try_setup_line( struct lp_setup_context *setup,
       nr_planes = 8;
       if (setup->viewport_index_slot > 0) {
          unsigned *udata = (unsigned*)v1[setup->viewport_index_slot];
-         scissor_index = *udata;
+         scissor_index = lp_clamp_scissor_idx(*udata);
       }
    }
    else {
diff --git a/src/gallium/drivers/llvmpipe/lp_setup_point.c b/src/gallium/drivers/llvmpipe/lp_setup_point.c
index 30ce7490de9..b8040ae56f6 100644
--- a/src/gallium/drivers/llvmpipe/lp_setup_point.c
+++ b/src/gallium/drivers/llvmpipe/lp_setup_point.c
@@ -328,7 +328,7 @@ try_setup_point( struct lp_setup_context *setup,
 
    if (setup->viewport_index_slot > 0) {
       unsigned *udata = (unsigned*)v0[setup->viewport_index_slot];
-      scissor_index = *udata;
+      scissor_index = lp_clamp_scissor_idx(*udata);
    }
    /* Bounding rectangle (in pixels) */
    {
diff --git a/src/gallium/drivers/llvmpipe/lp_setup_tri.c b/src/gallium/drivers/llvmpipe/lp_setup_tri.c
index c1ba52e8ca6..e0aaa196c9a 100644
--- a/src/gallium/drivers/llvmpipe/lp_setup_tri.c
+++ b/src/gallium/drivers/llvmpipe/lp_setup_tri.c
@@ -258,7 +258,7 @@ do_triangle_ccw(struct lp_setup_context *setup,
       nr_planes = 7;
       if (setup->viewport_index_slot > 0) {
          unsigned *udata = (unsigned*)v0[setup->viewport_index_slot];
-         scissor_index = *udata;
+         scissor_index = lp_clamp_scissor_idx(*udata);
       }
    }
    else {
diff --git a/src/gallium/drivers/llvmpipe/lp_state_clip.c b/src/gallium/drivers/llvmpipe/lp_state_clip.c
index 0e027fa9128..2d4f27c78ab 100644
--- a/src/gallium/drivers/llvmpipe/lp_state_clip.c
+++ b/src/gallium/drivers/llvmpipe/lp_state_clip.c
@@ -71,8 +71,12 @@ llvmpipe_set_scissor_states(struct pipe_context *pipe,
 
    draw_flush(llvmpipe->draw);
 
+   debug_assert(start_slot < PIPE_MAX_VIEWPORTS);
+   debug_assert((start_slot + num_scissors) <= PIPE_MAX_VIEWPORTS);
+
    memcpy(llvmpipe->scissors + start_slot, scissors,
           sizeof(struct pipe_scissor_state) * num_scissors);
+   
    llvmpipe->dirty |= LP_NEW_SCISSOR;
 }