From d33bf38d63d233f6a09115acfff230c464d3ee29 Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Tue, 8 Dec 2009 17:51:07 -0800
Subject: mesa: Fix array out-of-bounds access by _mesa_Fogf.

_mesa_Fogf calls _mesa_Fogfv, which uses the params argument
as an array.
---
 src/mesa/main/fog.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/mesa/main/fog.c b/src/mesa/main/fog.c
index 99eb141812e..269ff3f8b99 100644
--- a/src/mesa/main/fog.c
+++ b/src/mesa/main/fog.c
@@ -34,7 +34,10 @@
 void GLAPIENTRY
 _mesa_Fogf(GLenum pname, GLfloat param)
 {
-   _mesa_Fogfv(pname, &param);
+   GLfloat fparam[4];
+   fparam[0] = param;
+   fparam[1] = fparam[2] = fparam[3] = 0.0F;
+   _mesa_Fogfv(pname, fparam);
 }
 
 
-- 
cgit v1.2.3