diff options
author | Zack Rusin <zackr@vmware.com> | 2013-05-08 23:48:20 -0400 |
---|---|---|
committer | Zack Rusin <zackr@vmware.com> | 2013-05-14 03:09:32 -0400 |
commit | 29853ab7b8656cee9b92a53bec43f6e9f1e49691 (patch) | |
tree | 6b4ac7f1accc0358717fe98d6e8b1c5b982baafb /src/gallium/drivers/r300/r300_state.c | |
parent | 386327c48f88b052449afa4f41b1090d3fdb5ce9 (diff) | |
download | external_mesa3d-29853ab7b8656cee9b92a53bec43f6e9f1e49691.zip external_mesa3d-29853ab7b8656cee9b92a53bec43f6e9f1e49691.tar.gz external_mesa3d-29853ab7b8656cee9b92a53bec43f6e9f1e49691.tar.bz2 |
draw: don't crash on vertex buffer overflow
We would crash when stride was bigger than the size of the buffer.
The correct behavior is to just fetch zero's in this case.
Unfortunatly with user_buffer's there's no way to validate the size
because currently we're just not getting it. Adjust the draw interface
to pass the size along the mapped buffer, which works perfectly
for buffer backed vertex_buffers and, in future, it will allow
us to plumb user_buffer sizes through the same interface.
Signed-off-by: Zack Rusin <zackr@vmware.com>
Reviewed-by: José Fonseca <jfonseca@vmware.com>
Reviewed-by: Roland Scheidegger <sroland@vmware.com>
Diffstat (limited to 'src/gallium/drivers/r300/r300_state.c')
-rw-r--r-- | src/gallium/drivers/r300/r300_state.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/gallium/drivers/r300/r300_state.c b/src/gallium/drivers/r300/r300_state.c index 2de0fd6..b3e25e1 100644 --- a/src/gallium/drivers/r300/r300_state.c +++ b/src/gallium/drivers/r300/r300_state.c @@ -1821,10 +1821,10 @@ static void r300_set_vertex_buffers_swtcl(struct pipe_context* pipe, for (i = 0; i < count; i++) { if (buffers[i].user_buffer) { draw_set_mapped_vertex_buffer(r300->draw, start_slot + i, - buffers[i].user_buffer); + buffers[i].user_buffer, ~0); } else if (buffers[i].buffer) { draw_set_mapped_vertex_buffer(r300->draw, start_slot + i, - r300_resource(buffers[i].buffer)->malloced_buffer); + r300_resource(buffers[i].buffer)->malloced_buffer, ~0); } } } |