From 13f96c5401ffe3869f08fecb2baf5bff2438b02e Mon Sep 17 00:00:00 2001
From: Brian Paul <brian.paul@tungstengraphics.com>
Date: Mon, 10 Nov 2008 14:27:42 -0700
Subject: GLX: fix out-of-bounds memory issue in indirect
 glAreTexturesResident()

See bug 18445.
When getting array results, __glXReadReply() always reads a multiple of
four bytes.  This can cause writing to invalid memory when 'n' is not a
multiple of four.

Special-case the glAreTexturesResident() functions now.
To fix the bug, we use a temporary buffer that's a multiple of four bytes
in length.

NOTE: this commit also reverts part of commit 919ec22ecf72aa163e1b97d8c7381002131ed32c
(glx/x11: Added some #ifdef GLX_DIRECT_RENDERING protection) which
directly edited the indirect.c file rather than the python generator!
I'm not repairing that issue at this time.
---
 src/mesa/glapi/gl_API.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'src/mesa/glapi/gl_API.xml')

diff --git a/src/mesa/glapi/gl_API.xml b/src/mesa/glapi/gl_API.xml
index 2d8a967ba79..6c0367aad79 100644
--- a/src/mesa/glapi/gl_API.xml
+++ b/src/mesa/glapi/gl_API.xml
@@ -3289,7 +3289,7 @@
         <param name="textures" type="const GLuint *" count="n"/>
         <param name="residences" type="GLboolean *" output="true" count="n"/>
         <return type="GLboolean"/>
-        <glx sop="143" always_array="true"/>
+        <glx sop="143" handcode="client" always_array="true"/>
     </function>
 
     <function name="BindTexture" offset="307">
@@ -8645,7 +8645,7 @@
         <param name="textures" type="const GLuint *" count="n"/>
         <param name="residences" type="GLboolean *" output="true" count="n"/>
         <return type="GLboolean"/>
-        <glx vendorpriv="11" always_array="true"/>
+        <glx vendorpriv="11" handcode="client" always_array="true"/>
     </function>
 
     <function name="BindTextureEXT" alias="BindTexture">
-- 
cgit v1.2.3