From 7f8e22aa29b7340d51b1f2e16d55a035c0f9b851 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 00:26:37 -0800
Subject: rbug: Initialize variable in rbug_get_message.

Silences uninitialized variable warning.
---
 src/gallium/auxiliary/rbug/rbug_connection.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/gallium/auxiliary/rbug/rbug_connection.c b/src/gallium/auxiliary/rbug/rbug_connection.c
index 52acb700af9..ae4e27f9f6b 100644
--- a/src/gallium/auxiliary/rbug/rbug_connection.c
+++ b/src/gallium/auxiliary/rbug/rbug_connection.c
@@ -87,6 +87,7 @@ rbug_get_message(struct rbug_connection *c, uint32_t *serial)
    if (!data) {
       return NULL;
    }
+   data->opcode = 0;
 
    do {
       uint8_t *ptr = ((uint8_t*)data) + read;
-- 
cgit v1.2.3


From 7e93e06781d2f3e0c737c7654c3fb0d83e31e45a Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 00:37:35 -0800
Subject: i915g: Add missing break statement in i915_debug_packet.

---
 src/gallium/drivers/i915simple/i915_debug.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/gallium/drivers/i915simple/i915_debug.c b/src/gallium/drivers/i915simple/i915_debug.c
index ce92d1af9a7..521b5164702 100644
--- a/src/gallium/drivers/i915simple/i915_debug.c
+++ b/src/gallium/drivers/i915simple/i915_debug.c
@@ -851,6 +851,7 @@ static boolean i915_debug_packet( struct debug_stream *stream )
       default:
 	 return debug(stream, "", 0);
       }
+      break;
    default:
       assert(0);
       return 0;
-- 
cgit v1.2.3


From 1de1deffce9c7120a167af8553b606eec82e60a3 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 00:43:38 -0800
Subject: i915g: Fix memory leak when pci id is unknown.

---
 src/gallium/drivers/i915simple/i915_screen.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/gallium/drivers/i915simple/i915_screen.c b/src/gallium/drivers/i915simple/i915_screen.c
index 9f017a14cca..9557c80ce12 100644
--- a/src/gallium/drivers/i915simple/i915_screen.c
+++ b/src/gallium/drivers/i915simple/i915_screen.c
@@ -273,6 +273,7 @@ i915_create_screen(struct intel_winsys *iws, uint pci_id)
    default:
       debug_printf("%s: unknown pci id 0x%x, cannot create screen\n", 
                    __FUNCTION__, pci_id);
+      FREE(is);
       return NULL;
    }
 
-- 
cgit v1.2.3


From 54b0ed8360019fc6e0234c2c3413be40fe4d3b59 Mon Sep 17 00:00:00 2001
From: Brian Paul <brianp@vmware.com>
Date: Tue, 8 Dec 2009 15:03:15 -0700
Subject: vbo: fix array index out of bounds error, and fix evaluator
 priorities

Fixes bug 25525.
Plus, the GL_NV_vertex_program evaluators alias and override the
convential evaluator maps, so set their state after the conventional
maps.
---
 src/mesa/vbo/vbo_exec_eval.c | 33 +++++++++++++++++++++------------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/src/mesa/vbo/vbo_exec_eval.c b/src/mesa/vbo/vbo_exec_eval.c
index 0c691b3a5cd..a7846213d0c 100644
--- a/src/mesa/vbo/vbo_exec_eval.c
+++ b/src/mesa/vbo/vbo_exec_eval.c
@@ -35,17 +35,20 @@
 
 static void clear_active_eval1( struct vbo_exec_context *exec, GLuint attr ) 
 {
+   assert(attr < Elements(exec->eval.map1));
    exec->eval.map1[attr].map = NULL;
 }
 
 static void clear_active_eval2( struct vbo_exec_context *exec, GLuint attr ) 
 {
+   assert(attr < Elements(exec->eval.map2));
    exec->eval.map2[attr].map = NULL;
 }
 
 static void set_active_eval1( struct vbo_exec_context *exec, GLuint attr, GLuint dim, 
 			      struct gl_1d_map *map )
 {
+   assert(attr < Elements(exec->eval.map1));
    if (!exec->eval.map1[attr].map) {
       exec->eval.map1[attr].map = map;
       exec->eval.map1[attr].sz = dim;
@@ -55,6 +58,7 @@ static void set_active_eval1( struct vbo_exec_context *exec, GLuint attr, GLuint
 static void set_active_eval2( struct vbo_exec_context *exec, GLuint attr, GLuint dim, 
 			      struct gl_2d_map *map )
 {
+   assert(attr < Elements(exec->eval.map2));
    if (!exec->eval.map2[attr].map) {
       exec->eval.map2[attr].map = map;
       exec->eval.map2[attr].sz = dim;
@@ -73,18 +77,6 @@ void vbo_exec_eval_update( struct vbo_exec_context *exec )
       clear_active_eval2( exec, attr );
    }
 
-   /* _NEW_PROGRAM */
-   if (ctx->VertexProgram._Enabled) {
-      for (attr = 0; attr < VBO_ATTRIB_FIRST_MATERIAL; attr++) {
-	 /* _NEW_EVAL */
-	 if (ctx->Eval.Map1Attrib[attr]) 
-	    set_active_eval1( exec, attr, 4, &ctx->EvalMap.Map1Attrib[attr] );
-
-	 if (ctx->Eval.Map2Attrib[attr]) 
-	    set_active_eval2( exec, attr, 4, &ctx->EvalMap.Map2Attrib[attr] );
-      }
-   }
-
    if (ctx->Eval.Map1Color4) 
       set_active_eval1( exec, VBO_ATTRIB_COLOR0, 4, &ctx->EvalMap.Map1Color4 );
       
@@ -125,6 +117,23 @@ void vbo_exec_eval_update( struct vbo_exec_context *exec )
    else if (ctx->Eval.Map2Vertex3) 
       set_active_eval2( exec, VBO_ATTRIB_POS, 3, &ctx->EvalMap.Map2Vertex3 );
 
+   /* _NEW_PROGRAM */
+   if (ctx->VertexProgram._Enabled) {
+      /* These are the 16 evaluators which GL_NV_vertex_program defines.
+       * They alias and override the conventional vertex attributs.
+       */
+      for (attr = 0; attr < 16; attr++) {
+         /* _NEW_EVAL */
+         assert(attr < Elements(ctx->Eval.Map1Attrib));
+         if (ctx->Eval.Map1Attrib[attr]) 
+            set_active_eval1( exec, attr, 4, &ctx->EvalMap.Map1Attrib[attr] );
+
+         assert(attr < Elements(ctx->Eval.Map2Attrib));
+         if (ctx->Eval.Map2Attrib[attr]) 
+            set_active_eval2( exec, attr, 4, &ctx->EvalMap.Map2Attrib[attr] );
+      }
+   }
+
    exec->eval.recalculate_maps = 0;
 }
 
-- 
cgit v1.2.3


From d88f3b946804f9a3e8cad4f8896e6be488fec2b5 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 14:31:38 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameterfv.

_mesa_TexParameterfv calls set_tex_parameteri, which uses the
params argument as an array.
---
 src/mesa/main/texparam.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c
index 4ce8c8593a9..4c1f690ff1c 100644
--- a/src/mesa/main/texparam.c
+++ b/src/mesa/main/texparam.c
@@ -592,8 +592,10 @@ _mesa_TexParameterfv(GLenum target, GLenum pname, const GLfloat *params)
    case GL_DEPTH_TEXTURE_MODE_ARB:
       {
          /* convert float param to int */
-         GLint p = (GLint) params[0];
-         need_update = set_tex_parameteri(ctx, texObj, pname, &p);
+         GLint p[4];
+         p[0] = (GLint) params[0];
+         p[1] = p[2] = p[3] = 0;
+         need_update = set_tex_parameteri(ctx, texObj, pname, p);
       }
       break;
 
-- 
cgit v1.2.3


From a1d46fbea0b40d7edc668ea5993ea4318f37c9f9 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 15:42:13 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameteri.

_mesa_TexParameteri calls set_tex_parameterf, which uses the
params argument as an array.
---
 src/mesa/main/texparam.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c
index 4c1f690ff1c..59c518c7d25 100644
--- a/src/mesa/main/texparam.c
+++ b/src/mesa/main/texparam.c
@@ -644,9 +644,11 @@ _mesa_TexParameteri(GLenum target, GLenum pname, GLint param)
    case GL_TEXTURE_LOD_BIAS:
    case GL_TEXTURE_COMPARE_FAIL_VALUE_ARB:
       {
-         GLfloat fparam = (GLfloat) param;
+         GLfloat fparam[4];
+         fparam[0] = (GLfloat) param;
+         fparam[1] = fparam[2] = fparam[3] = 0.0F;
          /* convert int param to float */
-         need_update = set_tex_parameterf(ctx, texObj, pname, &fparam);
+         need_update = set_tex_parameterf(ctx, texObj, pname, fparam);
       }
       break;
    default:
-- 
cgit v1.2.3


From 7f146b38240e1c4efa6d8d0a4e5a0c8346706de5 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 16:04:33 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_Fogi.

_mesa_Fogi calls _mesa_Fogfv, which uses the params argument
as an array.
---
 src/mesa/main/fog.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/mesa/main/fog.c b/src/mesa/main/fog.c
index 4323d3db820..99eb141812e 100644
--- a/src/mesa/main/fog.c
+++ b/src/mesa/main/fog.c
@@ -41,8 +41,10 @@ _mesa_Fogf(GLenum pname, GLfloat param)
 void GLAPIENTRY
 _mesa_Fogi(GLenum pname, GLint param )
 {
-   GLfloat fparam = (GLfloat) param;
-   _mesa_Fogfv(pname, &fparam);
+   GLfloat fparam[4];
+   fparam[0] = (GLfloat) param;
+   fparam[1] = fparam[2] = fparam[3] = 0.0F;
+   _mesa_Fogfv(pname, fparam);
 }
 
 
-- 
cgit v1.2.3


From 3f7c2ac2798b385bed97b6931a1568a7e0223a0a Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 17:25:05 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameteri.

_mesa_TexParameteri calls set_tex_parameteri, which uses the
params argument as an array.
---
 src/mesa/main/texparam.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c
index 59c518c7d25..1cec4b82fea 100644
--- a/src/mesa/main/texparam.c
+++ b/src/mesa/main/texparam.c
@@ -653,7 +653,12 @@ _mesa_TexParameteri(GLenum target, GLenum pname, GLint param)
       break;
    default:
       /* this will generate an error if pname is illegal */
-      need_update = set_tex_parameteri(ctx, texObj, pname, &param);
+      {
+         GLint iparam[4];
+         iparam[0] = param;
+         iparam[1] = iparam[2] = iparam[3] = 0;
+         need_update = set_tex_parameteri(ctx, texObj, pname, iparam);
+      }
    }
 
    if (ctx->Driver.TexParameter && need_update) {
-- 
cgit v1.2.3


From d33bf38d63d233f6a09115acfff230c464d3ee29 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 17:51:07 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_Fogf.

_mesa_Fogf calls _mesa_Fogfv, which uses the params argument
as an array.
---
 src/mesa/main/fog.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/mesa/main/fog.c b/src/mesa/main/fog.c
index 99eb141812e..269ff3f8b99 100644
--- a/src/mesa/main/fog.c
+++ b/src/mesa/main/fog.c
@@ -34,7 +34,10 @@
 void GLAPIENTRY
 _mesa_Fogf(GLenum pname, GLfloat param)
 {
-   _mesa_Fogfv(pname, &param);
+   GLfloat fparam[4];
+   fparam[0] = param;
+   fparam[1] = fparam[2] = fparam[3] = 0.0F;
+   _mesa_Fogfv(pname, fparam);
 }
 
 
-- 
cgit v1.2.3


From af16c822a5af8ce0aa7582e8ea44315b62b7356b Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 18:26:05 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_LightModeli.

_mesa_LightModeli calls _mesa_LightModeliv, which uses the
params argument as an array.
---
 src/mesa/main/light.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c
index 10c89f43688..5a8f9160f62 100644
--- a/src/mesa/main/light.c
+++ b/src/mesa/main/light.c
@@ -537,7 +537,10 @@ _mesa_LightModeliv( GLenum pname, const GLint *params )
 void GLAPIENTRY
 _mesa_LightModeli( GLenum pname, GLint param )
 {
-   _mesa_LightModeliv( pname, &param );
+   GLint iparam[4];
+   iparam[0] = param;
+   iparam[1] = iparam[2] = iparam[3] = 0;
+   _mesa_LightModeliv( pname, iparam );
 }
 
 
-- 
cgit v1.2.3


From 33a120e4761a661736ea64a3efc2e3831ac5600a Mon Sep 17 00:00:00 2001
From: Andre Maasikas <amaasikas@gmail.com>
Date: Wed, 9 Dec 2009 10:51:52 +0200
Subject: r600: fix state size prediction after dc0777d3

---
 src/mesa/drivers/dri/r600/r700_chip.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/mesa/drivers/dri/r600/r700_chip.c b/src/mesa/drivers/dri/r600/r700_chip.c
index d8661b44397..dacc2ccc4c1 100644
--- a/src/mesa/drivers/dri/r600/r700_chip.c
+++ b/src/mesa/drivers/dri/r600/r700_chip.c
@@ -1134,7 +1134,11 @@ static int check_blnd(GLcontext *ctx, struct radeon_state_atom *atom)
 		count += 3;
 
 	if (context->radeon.radeonScreen->chip_family > CHIP_FAMILY_R600) {
-		for (ui = 0; ui < R700_MAX_RENDER_TARGETS; ui++) {
+		/* targets are enabled in r700SetRenderTarget but state
+		   size is calculated before that. Until MRT's are done
+		   hardcode target0 as enabled. */
+		count += 3;
+		for (ui = 1; ui < R700_MAX_RENDER_TARGETS; ui++) {
                         if (r700->render_target[ui].enabled)
 				count += 3;
 		}
-- 
cgit v1.2.3


From 3de8fff45d04fd7e702cd656ba97cafd348c3981 Mon Sep 17 00:00:00 2001
From: Brian Paul <brianp@vmware.com>
Date: Wed, 9 Dec 2009 08:30:01 -0700
Subject: mesa: fix baseLevel >= MAX_TEXTURE_LEVELS test

This fixes invalid array indexing when baseLevel == MAX_TEXTURE_LEVELS.
See bug 25528.
---
 src/mesa/main/texobj.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/mesa/main/texobj.c b/src/mesa/main/texobj.c
index da55ac8697d..85f5f78e509 100644
--- a/src/mesa/main/texobj.c
+++ b/src/mesa/main/texobj.c
@@ -418,7 +418,7 @@ _mesa_test_texobj_completeness( const GLcontext *ctx,
    /* Detect cases where the application set the base level to an invalid
     * value.
     */
-   if ((baseLevel < 0) || (baseLevel > MAX_TEXTURE_LEVELS)) {
+   if ((baseLevel < 0) || (baseLevel >= MAX_TEXTURE_LEVELS)) {
       char s[100];
       _mesa_sprintf(s, "base level = %d is invalid", baseLevel);
       incomplete(t, s);
-- 
cgit v1.2.3


From a082d965de228d5035e59245df528af62761652a Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Wed, 9 Dec 2009 11:26:24 -0800
Subject: glsl: Remove unused member x from struct slang_operation.

---
 src/mesa/shader/slang/slang_compile_operation.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/mesa/shader/slang/slang_compile_operation.h b/src/mesa/shader/slang/slang_compile_operation.h
index 58f1edeed85..1f15c198963 100644
--- a/src/mesa/shader/slang/slang_compile_operation.h
+++ b/src/mesa/shader/slang/slang_compile_operation.h
@@ -127,7 +127,6 @@ typedef struct slang_operation_
     * indicate such.  num_children indicates number of elements.
     */
    GLboolean array_constructor;
-   double x;
 } slang_operation;
 
 
-- 
cgit v1.2.3


From 637970aefdcdd1ee50e3759de384b82e6109a45c Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Wed, 9 Dec 2009 12:43:28 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_LightModelf.

_mesa_LightModelf calls _mesa_LightModelfv, which uses the
params argument as an array.
---
 src/mesa/main/light.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c
index 5a8f9160f62..c1d47de3305 100644
--- a/src/mesa/main/light.c
+++ b/src/mesa/main/light.c
@@ -547,7 +547,10 @@ _mesa_LightModeli( GLenum pname, GLint param )
 void GLAPIENTRY
 _mesa_LightModelf( GLenum pname, GLfloat param )
 {
-   _mesa_LightModelfv( pname, &param );
+   GLfloat fparam[4];
+   fparam[0] = param;
+   fparam[1] = fparam[2] = fparam[3] = 0.0F;
+   _mesa_LightModelfv( pname, fparam );
 }
 
 
-- 
cgit v1.2.3


From 6f2d51b81ff907af9727e90153a46e79e246fc66 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Wed, 9 Dec 2009 13:00:22 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_PointParameterf.

_mesa_PointParameterf calls _mesa_PointParameterfv, which uses the
params argument as an array.
---
 src/mesa/main/points.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/mesa/main/points.c b/src/mesa/main/points.c
index b3305448904..9ec21c9b767 100644
--- a/src/mesa/main/points.c
+++ b/src/mesa/main/points.c
@@ -90,7 +90,10 @@ _mesa_PointParameteriv( GLenum pname, const GLint *params )
 void GLAPIENTRY
 _mesa_PointParameterf( GLenum pname, GLfloat param)
 {
-   _mesa_PointParameterfv(pname, &param);
+   GLfloat p[3];
+   p[0] = param;
+   p[1] = p[2] = 0.0F;
+   _mesa_PointParameterfv(pname, p);
 }
 
 
-- 
cgit v1.2.3


From 348883076bd213ec733a1ba2a4768788e4669c97 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Wed, 9 Dec 2009 13:15:05 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_PointParameteri.

_mesa_PointParameteri calls _mesa_PointParameterfv, which uses the
params argument as an array.
---
 src/mesa/main/points.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/mesa/main/points.c b/src/mesa/main/points.c
index 9ec21c9b767..dcaeccd90d4 100644
--- a/src/mesa/main/points.c
+++ b/src/mesa/main/points.c
@@ -69,8 +69,10 @@ _mesa_PointSize( GLfloat size )
 void GLAPIENTRY
 _mesa_PointParameteri( GLenum pname, GLint param )
 {
-   const GLfloat value = (GLfloat) param;
-   _mesa_PointParameterfv(pname, &value);
+   GLfloat p[3];
+   p[0] = (GLfloat) param;
+   p[1] = p[2] = 0.0F;
+   _mesa_PointParameterfv(pname, p);
 }
 
 
-- 
cgit v1.2.3


From 34528a34c446afea4442f479713e7f926220f128 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Wed, 9 Dec 2009 17:11:30 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_Lightf.

---
 src/mesa/main/light.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c
index c1d47de3305..d4f3bb90265 100644
--- a/src/mesa/main/light.c
+++ b/src/mesa/main/light.c
@@ -206,7 +206,10 @@ _mesa_light(GLcontext *ctx, GLuint lnum, GLenum pname, const GLfloat *params)
 void GLAPIENTRY
 _mesa_Lightf( GLenum light, GLenum pname, GLfloat param )
 {
-   _mesa_Lightfv( light, pname, &param );
+   GLfloat fparam[4];
+   fparam[0] = param;
+   fparam[1] = fparam[2] = fparam[3] = 0.0F;
+   _mesa_Lightfv( light, pname, fparam );
 }
 
 
-- 
cgit v1.2.3


From 444d1f39108ab4419843f19f76c968cef3398bab Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Wed, 9 Dec 2009 17:34:50 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_Lighti.

_mesa_Lighti calls _mesa_Lightiv, which uses the params argument
as an array.
---
 src/mesa/main/light.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c
index d4f3bb90265..5150926159e 100644
--- a/src/mesa/main/light.c
+++ b/src/mesa/main/light.c
@@ -288,7 +288,10 @@ _mesa_Lightfv( GLenum light, GLenum pname, const GLfloat *params )
 void GLAPIENTRY
 _mesa_Lighti( GLenum light, GLenum pname, GLint param )
 {
-   _mesa_Lightiv( light, pname, &param );
+   GLint iparam[4];
+   iparam[0] = param;
+   iparam[1] = iparam[2] = iparam[3] = 0;
+   _mesa_Lightiv( light, pname, iparam );
 }
 
 
-- 
cgit v1.2.3


From b82757880545f8bce471ba8f13c16998888cd4b5 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Wed, 9 Dec 2009 17:59:23 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_TexGend.

_mesa_TexGend calls _mesa_TexGenfv, which uses the params argument
as an array.
---
 src/mesa/main/texgen.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/mesa/main/texgen.c b/src/mesa/main/texgen.c
index d3ea7b936b3..f9d38215d60 100644
--- a/src/mesa/main/texgen.c
+++ b/src/mesa/main/texgen.c
@@ -181,8 +181,10 @@ _mesa_TexGeniv(GLenum coord, GLenum pname, const GLint *params )
 void GLAPIENTRY
 _mesa_TexGend(GLenum coord, GLenum pname, GLdouble param )
 {
-   GLfloat p = (GLfloat) param;
-   _mesa_TexGenfv( coord, pname, &p );
+   GLfloat p[4];
+   p[0] = (GLfloat) param;
+   p[1] = p[2] = p[3] = 0.0F;
+   _mesa_TexGenfv( coord, pname, p );
 }
 
 
-- 
cgit v1.2.3


From dcb4a37fc89924192d923ed6906d2922371b8cb1 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Thu, 10 Dec 2009 12:11:09 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameteriv.

---
 src/mesa/main/texparam.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c
index 1cec4b82fea..0f83d226f28 100644
--- a/src/mesa/main/texparam.c
+++ b/src/mesa/main/texparam.c
@@ -700,8 +700,10 @@ _mesa_TexParameteriv(GLenum target, GLenum pname, const GLint *params)
    case GL_TEXTURE_COMPARE_FAIL_VALUE_ARB:
       {
          /* convert int param to float */
-         GLfloat fparam = (GLfloat) params[0];
-         need_update = set_tex_parameterf(ctx, texObj, pname, &fparam);
+         GLfloat fparams[4];
+         fparams[0] = (GLfloat) params[0];
+         fparams[1] = fparams[2] = fparams[3] = 0.0F;
+         need_update = set_tex_parameterf(ctx, texObj, pname, fparams);
       }
       break;
    default:
-- 
cgit v1.2.3


From 51f52edaf186a927a2c8c29ba9dba56d18928a7e Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Thu, 10 Dec 2009 12:37:10 -0800
Subject: glsl: Fix array out-of-bounds access by _slang_lookup_constant.

---
 src/mesa/shader/slang/slang_simplify.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/mesa/shader/slang/slang_simplify.c b/src/mesa/shader/slang/slang_simplify.c
index b8a21f642cb..539c6ff0d14 100644
--- a/src/mesa/shader/slang/slang_simplify.c
+++ b/src/mesa/shader/slang/slang_simplify.c
@@ -84,10 +84,11 @@ _slang_lookup_constant(const char *name)
    for (i = 0; info[i].Name; i++) {
       if (strcmp(info[i].Name, name) == 0) {
          /* found */
-         GLint value = -1;
-         _mesa_GetIntegerv(info[i].Token, &value);
-         ASSERT(value >= 0);  /* sanity check that glGetFloatv worked */
-         return value;
+         GLint values[4];
+         values[0] = -1;
+         _mesa_GetIntegerv(info[i].Token, values);
+         ASSERT(values[0] >= 0);  /* sanity check that glGetFloatv worked */
+         return values[0];
       }
    }
    return -1;
-- 
cgit v1.2.3


From bc0509bba8cc962a4ee2dafd684e153b3060262d Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Thu, 10 Dec 2009 13:24:15 -0800
Subject: progs/util: Byte swap individual members of struct _rawImageRec.

---
 progs/util/readtex.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/progs/util/readtex.c b/progs/util/readtex.c
index 81cb626e911..d1c50a494aa 100644
--- a/progs/util/readtex.c
+++ b/progs/util/readtex.c
@@ -117,7 +117,12 @@ static rawImageRec *RawImageOpen(const char *fileName)
    fread(raw, 1, 12, raw->file);
 
    if (swapFlag) {
-      ConvertShort(&raw->imagic, 6);
+      ConvertShort(&raw->imagic, 1);
+      ConvertShort(&raw->type, 1);
+      ConvertShort(&raw->dim, 1);
+      ConvertShort(&raw->sizeX, 1);
+      ConvertShort(&raw->sizeY, 1);
+      ConvertShort(&raw->sizeZ, 1);
    }
 
    raw->tmp = (unsigned char *)malloc(raw->sizeX*256);
-- 
cgit v1.2.3


From 1cf60c981091d7a46cb404fd607f85553c427761 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Thu, 10 Dec 2009 15:41:13 -0800
Subject: progs/samples: Byte swap individual members of struct _rawImageRec.

---
 progs/samples/rgbtoppm.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/progs/samples/rgbtoppm.c b/progs/samples/rgbtoppm.c
index 56ca5b0efe9..dcb74228dff 100644
--- a/progs/samples/rgbtoppm.c
+++ b/progs/samples/rgbtoppm.c
@@ -93,7 +93,12 @@ static ImageRec *ImageOpen(char *fileName)
     fread(image, 1, 12, image->file);
 
     if (swapFlag) {
-        ConvertShort(&image->imagic, 6);
+        ConvertShort(&image->imagic, 1);
+        ConvertShort(&image->type, 1);
+        ConvertShort(&image->dim, 1);
+        ConvertShort(&image->xsize, 1);
+        ConvertShort(&image->ysize, 1);
+        ConvertShort(&image->zsize, 1);
     }
 
     image->tmp = (unsigned char *)malloc(image->xsize*256);
-- 
cgit v1.2.3


From d38ffed5236adf3ee83c0bc5bdee0233ce566e01 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Thu, 10 Dec 2009 17:50:35 -0800
Subject: glsl: Increase size of array in_slang_lookup_constant from 4 to 16.

For some cases, _mesa_GetIntegerv reads up to params[15].
---
 src/mesa/shader/slang/slang_simplify.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/mesa/shader/slang/slang_simplify.c b/src/mesa/shader/slang/slang_simplify.c
index 539c6ff0d14..13b9ca3c877 100644
--- a/src/mesa/shader/slang/slang_simplify.c
+++ b/src/mesa/shader/slang/slang_simplify.c
@@ -84,7 +84,7 @@ _slang_lookup_constant(const char *name)
    for (i = 0; info[i].Name; i++) {
       if (strcmp(info[i].Name, name) == 0) {
          /* found */
-         GLint values[4];
+         GLint values[16];
          values[0] = -1;
          _mesa_GetIntegerv(info[i].Token, values);
          ASSERT(values[0] >= 0);  /* sanity check that glGetFloatv worked */
-- 
cgit v1.2.3


From cb1dcb55f9884431a5e2b90e9208b42558a95611 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Thu, 10 Dec 2009 18:21:59 -0800
Subject: i915: Add missing break statement in i915_debug_packet.

---
 src/mesa/drivers/dri/i915/i915_debug.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/mesa/drivers/dri/i915/i915_debug.c b/src/mesa/drivers/dri/i915/i915_debug.c
index f7bb7ea44c9..fecfac30339 100644
--- a/src/mesa/drivers/dri/i915/i915_debug.c
+++ b/src/mesa/drivers/dri/i915/i915_debug.c
@@ -806,6 +806,7 @@ static GLboolean i915_debug_packet( struct debug_stream *stream )
       default:
 	 return debug(stream, "", 0);
       }
+      break;
    default:
       assert(0);
       return 0;
-- 
cgit v1.2.3


From e31df54754e2305b7cc7072053bf5a4e0b477fd6 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Thu, 10 Dec 2009 18:32:33 -0800
Subject: mesa: Assign _mesa_lookup_parameter_index return value to GLint.

---
 src/mesa/shader/prog_parameter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/mesa/shader/prog_parameter.c b/src/mesa/shader/prog_parameter.c
index 2f029b02e50..f22492e029e 100644
--- a/src/mesa/shader/prog_parameter.c
+++ b/src/mesa/shader/prog_parameter.c
@@ -500,7 +500,7 @@ GLfloat *
 _mesa_lookup_parameter_value(const struct gl_program_parameter_list *paramList,
                              GLsizei nameLen, const char *name)
 {
-   GLuint i = _mesa_lookup_parameter_index(paramList, nameLen, name);
+   GLint i = _mesa_lookup_parameter_index(paramList, nameLen, name);
    if (i < 0)
       return NULL;
    else
-- 
cgit v1.2.3


From 94fba49be97008565c0225bc46894bfd9453bb5e Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Thu, 10 Dec 2009 18:51:51 -0800
Subject: mesa: Initialize variable in MatchInstruction.

---
 src/mesa/shader/nvfragparse.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/mesa/shader/nvfragparse.c b/src/mesa/shader/nvfragparse.c
index 0fd55524abf..b739a6aa07c 100644
--- a/src/mesa/shader/nvfragparse.c
+++ b/src/mesa/shader/nvfragparse.c
@@ -217,6 +217,12 @@ MatchInstruction(const GLubyte *token)
    const struct instruction_pattern *inst;
    struct instruction_pattern result;
 
+   result.name = NULL;
+   result.opcode = MAX_OPCODE; /* i.e. invalid instruction */
+   result.inputs = 0;
+   result.outputs = 0;
+   result.suffixes = 0;
+
    for (inst = Instructions; inst->name; inst++) {
       if (_mesa_strncmp((const char *) token, inst->name, 3) == 0) {
          /* matched! */
@@ -247,7 +253,7 @@ MatchInstruction(const GLubyte *token)
          return result;
       }
    }
-   result.opcode = MAX_OPCODE; /* i.e. invalid instruction */
+
    return result;
 }
 
-- 
cgit v1.2.3


From f7f1211b9b0a8fa0e5f5427b74b4eee4dabf65af Mon Sep 17 00:00:00 2001
From: Aurelien Jarno <aurel32@debian.org>
Date: Fri, 11 Dec 2009 08:46:54 -0700
Subject: sparc: additional preprocessor test for SPARC 64-bit

---
 src/mesa/sparc/xform.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/mesa/sparc/xform.S b/src/mesa/sparc/xform.S
index f2b9674bf2d..2a7cce41e5a 100644
--- a/src/mesa/sparc/xform.S
+++ b/src/mesa/sparc/xform.S
@@ -17,7 +17,7 @@
 
 #include "sparc_matrix.h"
 
-#if defined(SVR4) || defined(__SVR4) || defined(__svr4__)
+#if defined(SVR4) || defined(__SVR4) || defined(__svr4__) || defined(__arch64__)
 	/* Solaris requires this for 64-bit. */
         .register %g2, #scratch
         .register %g3, #scratch
-- 
cgit v1.2.3


From 5076a4f53a2f34cc9116b45951037f639885c7a1 Mon Sep 17 00:00:00 2001
From: Brian Paul <brianp@vmware.com>
Date: Fri, 11 Dec 2009 09:16:25 -0700
Subject: mesa: check dst reg in _mesa_find_free_register()

If a register was only being used as a destination (as will happen when
generated condition-codes) we missed its use.  So we'd errantly return
a register index that was really in-use, not free.

Fixes bug 25579.
---
 src/mesa/shader/program.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/src/mesa/shader/program.c b/src/mesa/shader/program.c
index 2cd6eb8a389..18d4ef97597 100644
--- a/src/mesa/shader/program.c
+++ b/src/mesa/shader/program.c
@@ -813,9 +813,17 @@ _mesa_find_free_register(const struct gl_program *prog, GLuint regFile)
       const struct prog_instruction *inst = prog->Instructions + i;
       const GLuint n = _mesa_num_inst_src_regs(inst->Opcode);
 
-      for (k = 0; k < n; k++) {
-         if (inst->SrcReg[k].File == regFile) {
-            used[inst->SrcReg[k].Index] = GL_TRUE;
+      /* check dst reg first */
+      if (inst->DstReg.File == regFile) {
+         used[inst->DstReg.Index] = GL_TRUE;
+      }
+      else {
+         /* check src regs otherwise */
+         for (k = 0; k < n; k++) {
+            if (inst->SrcReg[k].File == regFile) {
+               used[inst->SrcReg[k].Index] = GL_TRUE;
+               break;
+            }
          }
       }
    }
-- 
cgit v1.2.3