From d4fb7615b5a9c514d48fc78a01c52cb721b889c6 Mon Sep 17 00:00:00 2001 From: Brian Paul Date: Thu, 21 May 2009 16:52:45 -0600 Subject: mesa: use MAX_ values instead of literals --- src/mesa/vbo/vbo_exec_array.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/mesa/vbo/vbo_exec_array.c b/src/mesa/vbo/vbo_exec_array.c index 0d4cbe9a1e5..0e611840c2e 100644 --- a/src/mesa/vbo/vbo_exec_array.c +++ b/src/mesa/vbo/vbo_exec_array.c @@ -115,7 +115,7 @@ static void bind_array_obj( GLcontext *ctx ) } exec->array.legacy_array[VERT_ATTRIB_EDGEFLAG] = &arrayObj->EdgeFlag; - for (i = 0; i < 8; i++) + for (i = 0; i < MAX_TEXTURE_COORD_UNITS; i++) exec->array.legacy_array[VERT_ATTRIB_TEX0 + i] = &arrayObj->TexCoord[i]; for (i = 0; i < VERT_ATTRIB_MAX; i++) @@ -216,7 +216,7 @@ static void recalculate_input_bindings( GLcontext *ctx ) } } - for (i = 0; i < 16; i++) { + for (i = 0; i < MAX_VERTEX_ATTRIBS; i++) { if (exec->array.generic_array[i]->Enabled) inputs[VERT_ATTRIB_GENERIC0 + i] = exec->array.generic_array[i]; else { -- cgit v1.2.3 From 8da09e6924ca22ba7951d5a7673dfab2a711a997 Mon Sep 17 00:00:00 2001 From: Brian Paul Date: Thu, 21 May 2009 16:54:35 -0600 Subject: vbo: fix incorrect loop limit in bind_array_obj() The generic_array[] is 16 elements in size, but the loop was doing 32 iterations. The out of bounds array write was clobbering the following inputs[] array but as luck would have it, that didn't matter. --- src/mesa/vbo/vbo_exec_array.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/mesa/vbo/vbo_exec_array.c b/src/mesa/vbo/vbo_exec_array.c index 0e611840c2e..65fe197a4d7 100644 --- a/src/mesa/vbo/vbo_exec_array.c +++ b/src/mesa/vbo/vbo_exec_array.c @@ -118,8 +118,11 @@ static void bind_array_obj( GLcontext *ctx ) for (i = 0; i < MAX_TEXTURE_COORD_UNITS; i++) exec->array.legacy_array[VERT_ATTRIB_TEX0 + i] = &arrayObj->TexCoord[i]; - for (i = 0; i < VERT_ATTRIB_MAX; i++) + for (i = 0; i < MAX_VERTEX_ATTRIBS; i++) { + assert(i < Elements(arrayObj->VertexAttrib)); + assert(i < Elements(exec->array.generic_array)); exec->array.generic_array[i] = &arrayObj->VertexAttrib[i]; + } exec->array.array_obj = arrayObj->Name; } -- cgit v1.2.3