2 files changed, 41 insertions, 10 deletions

diff --git a/src/mesa/main/api_validate.c b/src/mesa/main/api_validate.c
index 53783b10e13..004a7595a02 100644
--- a/src/mesa/main/api_validate.c
+++ b/src/mesa/main/api_validate.c
@@ -65,6 +65,43 @@ _mesa_validate_DrawElements(GLcontext *ctx,
        && !(ctx->VertexProgram.Enabled && ctx->Array.VertexAttrib[0].Enabled))
       return GL_FALSE;
 
+   /* Vertex buffer object tests */
+   if (ctx->Array.ElementArrayBufferObj->Name) {
+      GLuint indexBytes;
+
+      /* use indices in the buffer object */
+      if (!ctx->Array.ElementArrayBufferObj->Data) {
+         _mesa_warning(ctx, "DrawElements with empty vertex elements buffer!");
+         return GL_FALSE;
+      }
+
+      /* make sure count doesn't go outside buffer bounds */
+      if (type == GL_UNSIGNED_INT) {
+         indexBytes = count * sizeof(GLuint);
+      }
+      else if (type == GL_UNSIGNED_BYTE) {
+         indexBytes = count * sizeof(GLubyte);
+      }
+      else {
+         ASSERT(type == GL_UNSIGNED_SHORT);
+         indexBytes = count * sizeof(GLushort);
+      }
+
+      if ((GLubyte *) indices + indexBytes >
+          ctx->Array.ElementArrayBufferObj->Data +
+          ctx->Array.ElementArrayBufferObj->Size) {
+         _mesa_warning(ctx, "glDrawElements index out of buffer bounds");
+         return GL_FALSE;
+      }
+
+      /* Actual address is the sum of pointers.  Indices may be used below. */
+      if (ctx->Const.CheckArrayBounds) {
+         indices = (const GLvoid *)
+            ADD_POINTERS(ctx->Array.ElementArrayBufferObj->Data,
+                         (const GLubyte *) indices);
+      }
+   }
+
    if (ctx->Const.CheckArrayBounds) {
       /* find max array index */
       GLuint max = 0;
diff --git a/src/mesa/main/varray.c b/src/mesa/main/varray.c
index ddd04b4c81c..8141cf92817 100644
--- a/src/mesa/main/varray.c
+++ b/src/mesa/main/varray.c
@@ -879,12 +879,6 @@ _mesa_MultiDrawElementsEXT( GLenum mode, const GLsizei *count, GLenum type,
 
    ASSERT_OUTSIDE_BEGIN_END_AND_FLUSH(ctx);
 
-   if (ctx->Array.ElementArrayBufferObj->Name) {
-      /* use indices in the buffer object */
-      ASSERT(ctx->Array.ElementArrayBufferObj->Data);
-      indices = (const GLvoid **) ctx->Array.ElementArrayBufferObj->Data;
-   }
-
    for (i = 0; i < primcount; i++) {
       if (count[i] > 0) {
          (ctx->Exec->DrawElements)(mode, count[i], type, indices[i]);
@@ -906,8 +900,8 @@ _mesa_MultiModeDrawArraysIBM( const GLenum * mode, const GLint * first,
 
    for ( i = 0 ; i < primcount ; i++ ) {
       if ( count[i] > 0 ) {
-	 (ctx->Exec->DrawArrays)( *(GLenum *) ((char *) mode + (i * modestride)),
-				  first[i], count[i] );
+         GLenum m = *((GLenum *) ((GLubyte *) mode + i * modestride));
+	 (ctx->Exec->DrawArrays)( m, first[i], count[i] );
       }
    }
 }
@@ -928,8 +922,8 @@ _mesa_MultiModeDrawElementsIBM( const GLenum * mode, const GLsizei * count,
 
    for ( i = 0 ; i < primcount ; i++ ) {
       if ( count[i] > 0 ) {
-	 (ctx->Exec->DrawElements)( *(GLenum *) ((char *) mode + (i * modestride)),
-				    count[i], type, indices[i] );
+         GLenum m = *((GLenum *) ((GLubyte *) mode + i * modestride));
+	 (ctx->Exec->DrawElements)( m, count[i], type, indices[i] );
       }
    }
 }