aboutsummaryrefslogtreecommitdiff
path: root/mesalib/src/mesa/main/pbo.c
diff options
context:
space:
mode:
authormarha <marha@users.sourceforge.net>2011-12-12 12:23:04 +0100
committermarha <marha@users.sourceforge.net>2011-12-12 12:23:04 +0100
commit5efb0a5e19b75137b7294b27f4e7878aeb8f0927 (patch)
treea8138a3cf2f3ed5beacd1ce9e44dda79b51f9ffd /mesalib/src/mesa/main/pbo.c
parent5b178ff5a5f0b6e481cf9fd9749eb7ef9581c987 (diff)
downloadvcxsrv-5efb0a5e19b75137b7294b27f4e7878aeb8f0927.tar.gz
vcxsrv-5efb0a5e19b75137b7294b27f4e7878aeb8f0927.tar.bz2
vcxsrv-5efb0a5e19b75137b7294b27f4e7878aeb8f0927.zip
libxtrans libX11 libxcb xserver mesa git update 12 dec 2011
Diffstat (limited to 'mesalib/src/mesa/main/pbo.c')
-rw-r--r--mesalib/src/mesa/main/pbo.c29
1 files changed, 16 insertions, 13 deletions
diff --git a/mesalib/src/mesa/main/pbo.c b/mesalib/src/mesa/main/pbo.c
index 41ff2ff44..d8fa9191d 100644
--- a/mesalib/src/mesa/main/pbo.c
+++ b/mesalib/src/mesa/main/pbo.c
@@ -68,8 +68,8 @@ _mesa_validate_pbo_access(GLuint dimensions,
GLenum format, GLenum type, GLsizei clientMemSize,
const GLvoid *ptr)
{
- const GLvoid *start, *end, *offset;
- const GLubyte *sizeAddr; /* buffer size, cast to a pointer */
+ /* unsigned, to detect overflow/wrap-around */
+ uintptr_t start, end, offset, size;
/* If no PBO is bound, 'ptr' is a pointer to client memory containing
'clientMemSize' bytes.
@@ -78,10 +78,10 @@ _mesa_validate_pbo_access(GLuint dimensions,
*/
if (!_mesa_is_bufferobj(pack->BufferObj)) {
offset = 0;
- sizeAddr = ((const GLubyte *) 0) + clientMemSize;
+ size = clientMemSize;
} else {
- offset = ptr;
- sizeAddr = ((const GLubyte *) 0) + pack->BufferObj->Size;
+ offset = (uintptr_t)ptr;
+ size = pack->BufferObj->Size;
/* The ARB_pixel_buffer_object spec says:
* "INVALID_OPERATION is generated by ColorTable, ColorSubTable,
* ConvolutionFilter2D, ConvolutionFilter1D, SeparableFilter2D,
@@ -93,27 +93,30 @@ _mesa_validate_pbo_access(GLuint dimensions,
* parameter."
*/
if (type != GL_BITMAP &&
- ((GLintptr)offset % _mesa_sizeof_packed_type(type)))
+ (offset % _mesa_sizeof_packed_type(type)))
return GL_FALSE;
}
- if (sizeAddr == 0)
+ if (size == 0)
/* no buffer! */
return GL_FALSE;
/* get the offset to the first pixel we'll read/write */
- start = _mesa_image_address(dimensions, pack, offset, width, height,
- format, type, 0, 0, 0);
+ start = _mesa_image_offset(dimensions, pack, width, height,
+ format, type, 0, 0, 0);
/* get the offset to just past the last pixel we'll read/write */
- end = _mesa_image_address(dimensions, pack, offset, width, height,
- format, type, depth-1, height-1, width);
+ end = _mesa_image_offset(dimensions, pack, width, height,
+ format, type, depth-1, height-1, width);
- if ((const GLubyte *) start > sizeAddr) {
+ start += offset;
+ end += offset;
+
+ if (start > size) {
/* This will catch negative values / wrap-around */
return GL_FALSE;
}
- if ((const GLubyte *) end > sizeAddr) {
+ if (end > size) {
/* Image read/write goes beyond end of buffer */
return GL_FALSE;
}