From 2065e380b2edafd6e38aa5bb0ff222dc1f6f5ad8 Mon Sep 17 00:00:00 2001 From: Ilia Mirkin Date: Fri, 5 Feb 2016 00:47:03 -0500 Subject: nvc0: avoid negatives in PUSH_SPACE argument Fixup to commit 03b3eb90d - the number of buffers could be larger than the number of elements, in which case we'd pass a negative argument to PUSH_SPACE, which would be bad. While we're at it, merge it with the other PUSH_SPACE at the top of the function. Signed-off-by: Ilia Mirkin Cc: mesa-stable@lists.freedesktop.org --- src/gallium/drivers/nouveau/nvc0/nvc0_vbo.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/gallium/drivers/nouveau/nvc0/nvc0_vbo.c b/src/gallium/drivers/nouveau/nvc0/nvc0_vbo.c index f7769da0503..44aed1adeeb 100644 --- a/src/gallium/drivers/nouveau/nvc0/nvc0_vbo.c +++ b/src/gallium/drivers/nouveau/nvc0/nvc0_vbo.c @@ -382,7 +382,7 @@ nvc0_validate_vertex_buffers_shared(struct nvc0_context *nvc0) unsigned b; const uint32_t mask = nvc0->vbo_user; - PUSH_SPACE(push, nvc0->num_vtxbufs * 8); + PUSH_SPACE(push, nvc0->num_vtxbufs * 8 + nvc0->vertex->num_elements); for (b = 0; b < nvc0->num_vtxbufs; ++b) { struct pipe_vertex_buffer *vb = &nvc0->vtxbuf[b]; struct nv04_resource *buf; @@ -417,7 +417,6 @@ nvc0_validate_vertex_buffers_shared(struct nvc0_context *nvc0) /* If there are more elements than buffers, we might not have unset * fetching on the later elements. */ - PUSH_SPACE(push, nvc0->vertex->num_elements - b); for (; b < nvc0->vertex->num_elements; ++b) IMMED_NVC0(push, NVC0_3D(VERTEX_ARRAY_FETCH(b)), 0); -- cgit v1.2.3