From d88f3b946804f9a3e8cad4f8896e6be488fec2b5 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Tue, 8 Dec 2009 14:31:38 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameterfv. _mesa_TexParameterfv calls set_tex_parameteri, which uses the params argument as an array. --- src/mesa/main/texparam.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/mesa/main') diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c index 4ce8c8593a9..4c1f690ff1c 100644 --- a/src/mesa/main/texparam.c +++ b/src/mesa/main/texparam.c @@ -592,8 +592,10 @@ _mesa_TexParameterfv(GLenum target, GLenum pname, const GLfloat *params) case GL_DEPTH_TEXTURE_MODE_ARB: { /* convert float param to int */ - GLint p = (GLint) params[0]; - need_update = set_tex_parameteri(ctx, texObj, pname, &p); + GLint p[4]; + p[0] = (GLint) params[0]; + p[1] = p[2] = p[3] = 0; + need_update = set_tex_parameteri(ctx, texObj, pname, p); } break; -- cgit v1.2.3 From a1d46fbea0b40d7edc668ea5993ea4318f37c9f9 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Tue, 8 Dec 2009 15:42:13 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameteri. _mesa_TexParameteri calls set_tex_parameterf, which uses the params argument as an array. --- src/mesa/main/texparam.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/mesa/main') diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c index 4c1f690ff1c..59c518c7d25 100644 --- a/src/mesa/main/texparam.c +++ b/src/mesa/main/texparam.c @@ -644,9 +644,11 @@ _mesa_TexParameteri(GLenum target, GLenum pname, GLint param) case GL_TEXTURE_LOD_BIAS: case GL_TEXTURE_COMPARE_FAIL_VALUE_ARB: { - GLfloat fparam = (GLfloat) param; + GLfloat fparam[4]; + fparam[0] = (GLfloat) param; + fparam[1] = fparam[2] = fparam[3] = 0.0F; /* convert int param to float */ - need_update = set_tex_parameterf(ctx, texObj, pname, &fparam); + need_update = set_tex_parameterf(ctx, texObj, pname, fparam); } break; default: -- cgit v1.2.3 From 7f146b38240e1c4efa6d8d0a4e5a0c8346706de5 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Tue, 8 Dec 2009 16:04:33 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_Fogi. _mesa_Fogi calls _mesa_Fogfv, which uses the params argument as an array. --- src/mesa/main/fog.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/mesa/main') diff --git a/src/mesa/main/fog.c b/src/mesa/main/fog.c index 4323d3db820..99eb141812e 100644 --- a/src/mesa/main/fog.c +++ b/src/mesa/main/fog.c @@ -41,8 +41,10 @@ _mesa_Fogf(GLenum pname, GLfloat param) void GLAPIENTRY _mesa_Fogi(GLenum pname, GLint param ) { - GLfloat fparam = (GLfloat) param; - _mesa_Fogfv(pname, &fparam); + GLfloat fparam[4]; + fparam[0] = (GLfloat) param; + fparam[1] = fparam[2] = fparam[3] = 0.0F; + _mesa_Fogfv(pname, fparam); } -- cgit v1.2.3 From 3f7c2ac2798b385bed97b6931a1568a7e0223a0a Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Tue, 8 Dec 2009 17:25:05 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameteri. _mesa_TexParameteri calls set_tex_parameteri, which uses the params argument as an array. --- src/mesa/main/texparam.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'src/mesa/main') diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c index 59c518c7d25..1cec4b82fea 100644 --- a/src/mesa/main/texparam.c +++ b/src/mesa/main/texparam.c @@ -653,7 +653,12 @@ _mesa_TexParameteri(GLenum target, GLenum pname, GLint param) break; default: /* this will generate an error if pname is illegal */ - need_update = set_tex_parameteri(ctx, texObj, pname, ¶m); + { + GLint iparam[4]; + iparam[0] = param; + iparam[1] = iparam[2] = iparam[3] = 0; + need_update = set_tex_parameteri(ctx, texObj, pname, iparam); + } } if (ctx->Driver.TexParameter && need_update) { -- cgit v1.2.3 From d33bf38d63d233f6a09115acfff230c464d3ee29 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Tue, 8 Dec 2009 17:51:07 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_Fogf. _mesa_Fogf calls _mesa_Fogfv, which uses the params argument as an array. --- src/mesa/main/fog.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/mesa/main') diff --git a/src/mesa/main/fog.c b/src/mesa/main/fog.c index 99eb141812e..269ff3f8b99 100644 --- a/src/mesa/main/fog.c +++ b/src/mesa/main/fog.c @@ -34,7 +34,10 @@ void GLAPIENTRY _mesa_Fogf(GLenum pname, GLfloat param) { - _mesa_Fogfv(pname, ¶m); + GLfloat fparam[4]; + fparam[0] = param; + fparam[1] = fparam[2] = fparam[3] = 0.0F; + _mesa_Fogfv(pname, fparam); } -- cgit v1.2.3 From af16c822a5af8ce0aa7582e8ea44315b62b7356b Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Tue, 8 Dec 2009 18:26:05 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_LightModeli. _mesa_LightModeli calls _mesa_LightModeliv, which uses the params argument as an array. --- src/mesa/main/light.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/mesa/main') diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c index 10c89f43688..5a8f9160f62 100644 --- a/src/mesa/main/light.c +++ b/src/mesa/main/light.c @@ -537,7 +537,10 @@ _mesa_LightModeliv( GLenum pname, const GLint *params ) void GLAPIENTRY _mesa_LightModeli( GLenum pname, GLint param ) { - _mesa_LightModeliv( pname, ¶m ); + GLint iparam[4]; + iparam[0] = param; + iparam[1] = iparam[2] = iparam[3] = 0; + _mesa_LightModeliv( pname, iparam ); } -- cgit v1.2.3 From 3de8fff45d04fd7e702cd656ba97cafd348c3981 Mon Sep 17 00:00:00 2001 From: Brian Paul Date: Wed, 9 Dec 2009 08:30:01 -0700 Subject: mesa: fix baseLevel >= MAX_TEXTURE_LEVELS test This fixes invalid array indexing when baseLevel == MAX_TEXTURE_LEVELS. See bug 25528. --- src/mesa/main/texobj.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/mesa/main') diff --git a/src/mesa/main/texobj.c b/src/mesa/main/texobj.c index da55ac8697d..85f5f78e509 100644 --- a/src/mesa/main/texobj.c +++ b/src/mesa/main/texobj.c @@ -418,7 +418,7 @@ _mesa_test_texobj_completeness( const GLcontext *ctx, /* Detect cases where the application set the base level to an invalid * value. */ - if ((baseLevel < 0) || (baseLevel > MAX_TEXTURE_LEVELS)) { + if ((baseLevel < 0) || (baseLevel >= MAX_TEXTURE_LEVELS)) { char s[100]; _mesa_sprintf(s, "base level = %d is invalid", baseLevel); incomplete(t, s); -- cgit v1.2.3 From 637970aefdcdd1ee50e3759de384b82e6109a45c Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Wed, 9 Dec 2009 12:43:28 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_LightModelf. _mesa_LightModelf calls _mesa_LightModelfv, which uses the params argument as an array. --- src/mesa/main/light.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/mesa/main') diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c index 5a8f9160f62..c1d47de3305 100644 --- a/src/mesa/main/light.c +++ b/src/mesa/main/light.c @@ -547,7 +547,10 @@ _mesa_LightModeli( GLenum pname, GLint param ) void GLAPIENTRY _mesa_LightModelf( GLenum pname, GLfloat param ) { - _mesa_LightModelfv( pname, ¶m ); + GLfloat fparam[4]; + fparam[0] = param; + fparam[1] = fparam[2] = fparam[3] = 0.0F; + _mesa_LightModelfv( pname, fparam ); } -- cgit v1.2.3 From 6f2d51b81ff907af9727e90153a46e79e246fc66 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Wed, 9 Dec 2009 13:00:22 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_PointParameterf. _mesa_PointParameterf calls _mesa_PointParameterfv, which uses the params argument as an array. --- src/mesa/main/points.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/mesa/main') diff --git a/src/mesa/main/points.c b/src/mesa/main/points.c index b3305448904..9ec21c9b767 100644 --- a/src/mesa/main/points.c +++ b/src/mesa/main/points.c @@ -90,7 +90,10 @@ _mesa_PointParameteriv( GLenum pname, const GLint *params ) void GLAPIENTRY _mesa_PointParameterf( GLenum pname, GLfloat param) { - _mesa_PointParameterfv(pname, ¶m); + GLfloat p[3]; + p[0] = param; + p[1] = p[2] = 0.0F; + _mesa_PointParameterfv(pname, p); } -- cgit v1.2.3 From 348883076bd213ec733a1ba2a4768788e4669c97 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Wed, 9 Dec 2009 13:15:05 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_PointParameteri. _mesa_PointParameteri calls _mesa_PointParameterfv, which uses the params argument as an array. --- src/mesa/main/points.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/mesa/main') diff --git a/src/mesa/main/points.c b/src/mesa/main/points.c index 9ec21c9b767..dcaeccd90d4 100644 --- a/src/mesa/main/points.c +++ b/src/mesa/main/points.c @@ -69,8 +69,10 @@ _mesa_PointSize( GLfloat size ) void GLAPIENTRY _mesa_PointParameteri( GLenum pname, GLint param ) { - const GLfloat value = (GLfloat) param; - _mesa_PointParameterfv(pname, &value); + GLfloat p[3]; + p[0] = (GLfloat) param; + p[1] = p[2] = 0.0F; + _mesa_PointParameterfv(pname, p); } -- cgit v1.2.3 From 34528a34c446afea4442f479713e7f926220f128 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Wed, 9 Dec 2009 17:11:30 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_Lightf. --- src/mesa/main/light.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/mesa/main') diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c index c1d47de3305..d4f3bb90265 100644 --- a/src/mesa/main/light.c +++ b/src/mesa/main/light.c @@ -206,7 +206,10 @@ _mesa_light(GLcontext *ctx, GLuint lnum, GLenum pname, const GLfloat *params) void GLAPIENTRY _mesa_Lightf( GLenum light, GLenum pname, GLfloat param ) { - _mesa_Lightfv( light, pname, ¶m ); + GLfloat fparam[4]; + fparam[0] = param; + fparam[1] = fparam[2] = fparam[3] = 0.0F; + _mesa_Lightfv( light, pname, fparam ); } -- cgit v1.2.3 From 444d1f39108ab4419843f19f76c968cef3398bab Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Wed, 9 Dec 2009 17:34:50 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_Lighti. _mesa_Lighti calls _mesa_Lightiv, which uses the params argument as an array. --- src/mesa/main/light.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/mesa/main') diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c index d4f3bb90265..5150926159e 100644 --- a/src/mesa/main/light.c +++ b/src/mesa/main/light.c @@ -288,7 +288,10 @@ _mesa_Lightfv( GLenum light, GLenum pname, const GLfloat *params ) void GLAPIENTRY _mesa_Lighti( GLenum light, GLenum pname, GLint param ) { - _mesa_Lightiv( light, pname, ¶m ); + GLint iparam[4]; + iparam[0] = param; + iparam[1] = iparam[2] = iparam[3] = 0; + _mesa_Lightiv( light, pname, iparam ); } -- cgit v1.2.3 From b82757880545f8bce471ba8f13c16998888cd4b5 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Wed, 9 Dec 2009 17:59:23 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_TexGend. _mesa_TexGend calls _mesa_TexGenfv, which uses the params argument as an array. --- src/mesa/main/texgen.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/mesa/main') diff --git a/src/mesa/main/texgen.c b/src/mesa/main/texgen.c index d3ea7b936b3..f9d38215d60 100644 --- a/src/mesa/main/texgen.c +++ b/src/mesa/main/texgen.c @@ -181,8 +181,10 @@ _mesa_TexGeniv(GLenum coord, GLenum pname, const GLint *params ) void GLAPIENTRY _mesa_TexGend(GLenum coord, GLenum pname, GLdouble param ) { - GLfloat p = (GLfloat) param; - _mesa_TexGenfv( coord, pname, &p ); + GLfloat p[4]; + p[0] = (GLfloat) param; + p[1] = p[2] = p[3] = 0.0F; + _mesa_TexGenfv( coord, pname, p ); } -- cgit v1.2.3 From dcb4a37fc89924192d923ed6906d2922371b8cb1 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Thu, 10 Dec 2009 12:11:09 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_TexParameteriv. --- src/mesa/main/texparam.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/mesa/main') diff --git a/src/mesa/main/texparam.c b/src/mesa/main/texparam.c index 1cec4b82fea..0f83d226f28 100644 --- a/src/mesa/main/texparam.c +++ b/src/mesa/main/texparam.c @@ -700,8 +700,10 @@ _mesa_TexParameteriv(GLenum target, GLenum pname, const GLint *params) case GL_TEXTURE_COMPARE_FAIL_VALUE_ARB: { /* convert int param to float */ - GLfloat fparam = (GLfloat) params[0]; - need_update = set_tex_parameterf(ctx, texObj, pname, &fparam); + GLfloat fparams[4]; + fparams[0] = (GLfloat) params[0]; + fparams[1] = fparams[2] = fparams[3] = 0.0F; + need_update = set_tex_parameterf(ctx, texObj, pname, fparams); } break; default: -- cgit v1.2.3