2 files changed, 18 insertions, 2 deletions
diff --git a/src/mesa/swrast/s_copypix.c b/src/mesa/swrast/s_copypix.c
index 3ba31f22c04..3bdf48b25f1 100644
--- a/src/mesa/swrast/s_copypix.c
+++ b/src/mesa/swrast/s_copypix.c
@@ -610,6 +610,7 @@ fast_copy_pixels(struct gl_context *ctx,
    struct gl_framebuffer *dstFb = ctx->DrawBuffer;
    struct gl_renderbuffer *srcRb, *dstRb;
    GLint row, yStep;
+   void *temp;
 
    if (SWRAST_CONTEXT(ctx)->_RasterMask != 0x0 ||
        ctx->Pixel.ZoomX != 1.0F ||
@@ -667,14 +668,21 @@ fast_copy_pixels(struct gl_context *ctx,
       yStep = 1;
    }
 
+   temp = malloc(width * MAX_PIXEL_BYTES);
+   if (!temp) {
+      _mesa_error(ctx, GL_OUT_OF_MEMORY, "glCopyPixels");
+      return GL_FALSE;
+   }
+
    for (row = 0; row < height; row++) {
-      GLuint temp[MAX_WIDTH][4];
       srcRb->GetRow(ctx, srcRb, width, srcX, srcY, temp);
       dstRb->PutRow(ctx, dstRb, width, dstX, dstY, temp, NULL);
       srcY += yStep;
       dstY += yStep;
    }
 
+   free(temp);
+
    return GL_TRUE;
 }
 
diff --git a/src/mesa/swrast/s_zoom.c b/src/mesa/swrast/s_zoom.c
index 16bb997f36c..f407fdcf4e6 100644
--- a/src/mesa/swrast/s_zoom.c
+++ b/src/mesa/swrast/s_zoom.c
@@ -299,11 +299,17 @@ zoom_span( struct gl_context *ctx, GLint imgX, GLint imgY, const SWspan *span,
        * Also, clipping may change the span end value, so store it as well.
        */
       const GLint end = zoomed.end; /* save */
-      GLuint rgbaSave[MAX_WIDTH][4];
+      void *rgbaSave;
       const GLint pixelSize =
          (zoomed.array->ChanType == GL_UNSIGNED_BYTE) ? 4 * sizeof(GLubyte) :
          ((zoomed.array->ChanType == GL_UNSIGNED_SHORT) ? 4 * sizeof(GLushort)
           : 4 * sizeof(GLfloat));
+
+      rgbaSave = malloc(zoomed.end * pixelSize);
+      if (!rgbaSave) {
+         return;
+      }
+
       if (y1 - y0 > 1) {
          memcpy(rgbaSave, zoomed.array->rgba, zoomed.end * pixelSize);
       }
@@ -315,6 +321,8 @@ zoom_span( struct gl_context *ctx, GLint imgX, GLint imgY, const SWspan *span,
             memcpy(zoomed.array->rgba, rgbaSave, zoomed.end * pixelSize);
          }
       }
+
+      free(rgbaSave);
    }
 }