diff options
| author | Brian Paul <brian.paul@tungstengraphics.com> | 2008-11-10 14:27:42 -0700 |
|---|---|---|
| committer | Brian Paul <brian.paul@tungstengraphics.com> | 2008-11-10 14:27:42 -0700 |
| commit | 13f96c5401ffe3869f08fecb2baf5bff2438b02e (patch) | |
| tree | a7b3e9c73b980cb9cb744d656c918eea69a3f66b /src/mesa/glapi | |
| parent | 6186e7a20676c5df30b1b4bffeec87afa1550e25 (diff) | |
GLX: fix out-of-bounds memory issue in indirect glAreTexturesResident()
See bug 18445.
When getting array results, __glXReadReply() always reads a multiple of
four bytes. This can cause writing to invalid memory when 'n' is not a
multiple of four.
Special-case the glAreTexturesResident() functions now.
To fix the bug, we use a temporary buffer that's a multiple of four bytes
in length.
NOTE: this commit also reverts part of commit 919ec22ecf72aa163e1b97d8c7381002131ed32c
(glx/x11: Added some #ifdef GLX_DIRECT_RENDERING protection) which
directly edited the indirect.c file rather than the python generator!
I'm not repairing that issue at this time.
Diffstat (limited to 'src/mesa/glapi')
| -rw-r--r-- | src/mesa/glapi/dispatch.h | 3 | ||||
| -rw-r--r-- | src/mesa/glapi/gl_API.xml | 4 |
2 files changed, 2 insertions, 5 deletions
diff --git a/src/mesa/glapi/dispatch.h b/src/mesa/glapi/dispatch.h index 98f654f402..7123156085 100644 --- a/src/mesa/glapi/dispatch.h +++ b/src/mesa/glapi/dispatch.h @@ -28,9 +28,6 @@ #if !defined( _DISPATCH_H_ ) # define _DISPATCH_H_ -#include "glapitable.h" - - /** * \file dispatch.h * Macros for handling GL dispatch tables. diff --git a/src/mesa/glapi/gl_API.xml b/src/mesa/glapi/gl_API.xml index 2d8a967ba7..6c0367aad7 100644 --- a/src/mesa/glapi/gl_API.xml +++ b/src/mesa/glapi/gl_API.xml @@ -3289,7 +3289,7 @@ <param name="textures" type="const GLuint *" count="n"/> <param name="residences" type="GLboolean *" output="true" count="n"/> <return type="GLboolean"/> - <glx sop="143" always_array="true"/> + <glx sop="143" handcode="client" always_array="true"/> </function> <function name="BindTexture" offset="307"> @@ -8645,7 +8645,7 @@ <param name="textures" type="const GLuint *" count="n"/> <param name="residences" type="GLboolean *" output="true" count="n"/> <return type="GLboolean"/> - <glx vendorpriv="11" always_array="true"/> + <glx vendorpriv="11" handcode="client" always_array="true"/> </function> <function name="BindTextureEXT" alias="BindTexture"> |