pixman xkbcomp libX11 libXau mesa fontconfig xserver xkeyboard-config git update 7 jan 2013

fontconfig: 17eda89ed2e24a3fc5f68538dd7fd9ada8efb087
xserver: bd91b05b631f13afd1f7a9d6cbc4f0c5408b523a
xkeyboard-config: 4779e2745094ebe0c06364b4099d7067ae750d07
libX11: cd25cab4b5b957641183ce72dd1ae0424aff1663
libXau: e04364efccbb3bb4cfc5f4cb491ffa1faaaacbdb
mesa: afec10df373f342f058aab66c622237964a4a147
pixman: 35cc965514ca6e665c18411fcf66db826d559c2a
xkbcomp: e4f767913338052527538d429931e8abd8c3fb88

1 files changed, 13 insertions, 13 deletions

diff --git a/mesalib/src/mesa/main/uniform_query.cpp b/mesalib/src/mesa/main/uniform_query.cpp
index b6b73d16f..afe9a08c1 100644
--- a/mesalib/src/mesa/main/uniform_query.cpp
+++ b/mesalib/src/mesa/main/uniform_query.cpp
@@ -241,11 +241,14 @@ validate_uniform_parameters(struct gl_context *ctx,
       return false;
    }
 
-   /* This case should be impossible.  The implication is that a call like
-    * glGetUniformLocation(prog, "foo[8]") was successful but "foo" is not an
-    * array.
+   /* If the uniform is an array, check that array_index is in bounds.
+    * If not an array, check that array_index is zero.
+    * array_index is unsigned so no need to check for less than zero.
     */
-   if (*array_index != 0 && shProg->UniformStorage[*loc].array_elements == 0) {
+   unsigned limit = shProg->UniformStorage[*loc].array_elements;
+   if (limit == 0)
+      limit = 1;
+   if (*array_index >= limit) {
       _mesa_error(ctx, GL_INVALID_OPERATION, "%s(location=%d)",
 		  caller, location);
       return false;
@@ -732,9 +735,6 @@ _mesa_uniform(struct gl_context *ctx, struct gl_shader_program *shProg,
     * will have already generated an error.
     */
    if (uni->array_elements != 0) {
-      if (offset >= uni->array_elements)
-	 return;
-
       count = MIN2(count, (int) (uni->array_elements - offset));
    }
 
@@ -889,9 +889,6 @@ _mesa_uniform_matrix(struct gl_context *ctx, struct gl_shader_program *shProg,
     * will have already generated an error.
     */
    if (uni->array_elements != 0) {
-      if (offset >= uni->array_elements)
-	 return;
-
       count = MIN2(count, (int) (uni->array_elements - offset));
    }
 
@@ -1025,10 +1022,13 @@ _mesa_get_uniform_location(struct gl_context *ctx,
    if (!found)
       return GL_INVALID_INDEX;
 
-   /* Since array_elements is 0 for non-arrays, this causes look-ups of 'a[0]'
-    * to (correctly) fail if 'a' is not an array.
+   /* If the uniform is an array, fail if the index is out of bounds.
+    * (A negative index is caught above.)  This also fails if the uniform
+    * is not an array, but the user is trying to index it, because
+    * array_elements is zero and offset >= 0.
     */
-   if (array_lookup && shProg->UniformStorage[location].array_elements == 0) {
+   if (array_lookup
+       && offset >= (long) shProg->UniformStorage[location].array_elements) {
       return GL_INVALID_INDEX;
    }