Squashed commit of the following:

commit 864fe253b04105b7469e5f7b064dc37637b944f8
Author: Brian Paul <brianp@vmware.com>
Date:   Thu Apr 21 20:13:07 2011 -0600

    mesa: s/exec/disp/ in _mesa_init_histogram_dispatch()

    This function isn't normally compiled (FEATURE_histogram).

commit f4bf45e2b94b582cacd19cdca873c5be627e4250
Author: nobled <nobled@dreamwidth.org>
Date:   Thu Apr 21 07:53:58 2011 -0600

    mesa: hook up GL_ARB_robustness dispatch functions

    ...and advertise the extension.

    Signed-off-by: Brian Paul <brianp@vmware.com>

commit 2b89e38e5f572dc40cebc06381ae7c5d04386998
Author: nobled <nobled@dreamwidth.org>
Date:   Thu Apr 21 07:53:58 2011 -0600

    mesa: regenerated API files for GL_ARB_robustness

    Signed-off-by: Brian Paul <brianp@vmware.com>

commit 5d5ebfb7135cec9d833adef86cbf4d0f3d9beca8
Author: nobled <nobled@dreamwidth.org>
Date:   Thu Apr 21 07:53:57 2011 -0600

    glapi: add ARB_robustness xml

    Signed-off-by: Brian Paul <brianp@vmware.com>

commit 0159d1d6d99f4bbc18381dc2081c20d3aff17ac9
Author: nobled <nobled@dreamwidth.org>
Date:   Thu Apr 21 07:53:57 2011 -0600

    mesa: implement GL_ARB_robustness functions

    Signed-off-by: Brian Paul <brianp@vmware.com>

commit 938fd71f4c4742f274922d53492a7290ab8d9c9b
Author: nobled <nobled@dreamwidth.org>
Date:   Thu Apr 21 07:53:57 2011 -0600

    mesa: add context fields for GL_ARB_robustness

    Signed-off-by: Brian Paul <brianp@vmware.com>

commit 72075137bc79e65be03dac7e97b6dba93c3a86a4
Author: nobled <nobled@dreamwidth.org>
Date:   Thu Apr 21 07:53:57 2011 -0600

    mesa: standardize more bounds-checking error messages

    Signed-off-by: Brian Paul <brianp@vmware.com>

commit 32a3fc23746db49da903fbc08afa0135af3007d2
Author: nobled <nobled@dreamwidth.org>
Date:   Thu Apr 21 07:53:57 2011 -0600

    mesa: standardize some bounds-checking error messages

    Signed-off-by: Brian Paul <brianp@vmware.com>

commit cecbf1f4d164207de373dec0cadee2e84e1f9656
Author: nobled <nobled@dreamwidth.org>
Date:   Thu Apr 21 07:53:57 2011 -0600

    mesa: add more bounds-checking support for client memory buffers

    Signed-off-by: Brian Paul <brianp@vmware.com>

commit edc895b52383d5bd274422db56adead1d81daf5f
Author: nobled <nobled@dreamwidth.org>
Date:   Thu Apr 21 07:53:57 2011 -0600

    mesa: add bounds-checking support for client memory buffers

    Signed-off-by: Brian Paul <brianp@vmware.com>

commit 3a96ef28a538f158a219b406cd090dee70470c85
Author: nobled <nobled@dreamwidth.org>
Date:   Thu Apr 21 07:53:57 2011 -0600

    mesa: use is_bufferobj() helper function

    Signed-off-by: Brian Paul <brianp@vmware.com>

1 files changed, 64 insertions, 44 deletions

diff --git a/src/mesa/main/pbo.c b/src/mesa/main/pbo.c
index 56b26a9..15e0480 100644
--- a/src/mesa/main/pbo.c
+++ b/src/mesa/main/pbo.c
@@ -43,7 +43,7 @@
  * When we're about to read pixel data out of a PBO (via glDrawPixels,
  * glTexImage, etc) or write data into a PBO (via glReadPixels,
  * glGetTexImage, etc) we call this function to check that we're not
- * going to read out of bounds.
+ * going to read/write out of bounds.
  *
  * XXX This would also be a convenient time to check that the PBO isn't
  * currently mapped.  Whoever calls this function should check for that.
@@ -56,43 +56,52 @@
  * \param depth  depth of image to read/write
  * \param format  format of image to read/write
  * \param type  datatype of image to read/write
+ * \param clientMemSize  the maximum number of bytes to read/write
  * \param ptr  the user-provided pointer/offset
- * \return GL_TRUE if the PBO access is OK, GL_FALSE if the access would
+ * \return GL_TRUE if the buffer access is OK, GL_FALSE if the access would
  *         go out of bounds.
  */
 GLboolean
 _mesa_validate_pbo_access(GLuint dimensions,
                           const struct gl_pixelstore_attrib *pack,
                           GLsizei width, GLsizei height, GLsizei depth,
-                          GLenum format, GLenum type, const GLvoid *ptr)
+                          GLenum format, GLenum type, GLsizei clientMemSize,
+                          const GLvoid *ptr)
 {
-   GLvoid *start, *end;
+   const GLvoid *start, *end, *offset;
    const GLubyte *sizeAddr; /* buffer size, cast to a pointer */
 
-   if (!_mesa_is_bufferobj(pack->BufferObj))
-      return GL_TRUE;  /* no PBO, OK */
+   /* If no PBO is bound, 'ptr' is a pointer to client memory containing
+      'clientMemSize' bytes.
+      If a PBO is bound, 'ptr' is an offset into the bound PBO.
+      In that case 'clientMemSize' is ignored: we just use the PBO's size.
+    */
+   if (!_mesa_is_bufferobj(pack->BufferObj)) {
+      offset = 0;
+      sizeAddr = ((const GLubyte *) 0) + clientMemSize;
+   } else {
+      offset = ptr;
+      sizeAddr = ((const GLubyte *) 0) + pack->BufferObj->Size;
+   }
 
-   if (pack->BufferObj->Size == 0)
+   if (sizeAddr == 0)
       /* no buffer! */
       return GL_FALSE;
 
-   /* get address of first pixel we'll read */
-   start = _mesa_image_address(dimensions, pack, ptr, width, height,
+   /* get the offset to the first pixel we'll read/write */
+   start = _mesa_image_address(dimensions, pack, offset, width, height,
                                format, type, 0, 0, 0);
 
-   /* get address just past the last pixel we'll read */
-   end = _mesa_image_address(dimensions, pack, ptr, width, height,
-                             format, type, depth-1, height-1, width);
-
-
-   sizeAddr = ((const GLubyte *) 0) + pack->BufferObj->Size;
+   /* get the offset to just past the last pixel we'll read/write */
+   end =  _mesa_image_address(dimensions, pack, offset, width, height,
+                              format, type, depth-1, height-1, width);
 
    if ((const GLubyte *) start > sizeAddr) {
       /* This will catch negative values / wrap-around */
       return GL_FALSE;
    }
    if ((const GLubyte *) end > sizeAddr) {
-      /* Image read goes beyond end of buffer */
+      /* Image read/write goes beyond end of buffer */
       return GL_FALSE;
    }
 
@@ -146,24 +155,30 @@ _mesa_map_pbo_source(struct gl_context *ctx,
  */
 const GLvoid *
 _mesa_map_validate_pbo_source(struct gl_context *ctx,
-                              GLuint dimensions,
-                              const struct gl_pixelstore_attrib *unpack,
-                              GLsizei width, GLsizei height, GLsizei depth,
-                              GLenum format, GLenum type, const GLvoid *ptr,
-                              const char *where)
+                                 GLuint dimensions,
+                                 const struct gl_pixelstore_attrib *unpack,
+                                 GLsizei width, GLsizei height, GLsizei depth,
+                                 GLenum format, GLenum type, GLsizei clientMemSize,
+                                 const GLvoid *ptr, const char *where)
 {
    ASSERT(dimensions == 1 || dimensions == 2 || dimensions == 3);
 
-   if (!_mesa_is_bufferobj(unpack->BufferObj)) {
-      /* non-PBO access: no validation to be done */
-      return ptr;
+   if (!_mesa_validate_pbo_access(dimensions, unpack, width, height, depth,
+                                  format, type, clientMemSize, ptr)) {
+      if (_mesa_is_bufferobj(unpack->BufferObj)) {
+         _mesa_error(ctx, GL_INVALID_OPERATION,
+                     "%s(out of bounds PBO access)", where);
+      } else {
+         _mesa_error(ctx, GL_INVALID_OPERATION,
+                     "%s(out of bounds access: bufSize (%d) is too small)",
+                     where, clientMemSize);
+      }
+      return NULL;
    }
 
-   if (!_mesa_validate_pbo_access(dimensions, unpack,
-                                  width, height, depth, format, type, ptr)) {
-      _mesa_error(ctx, GL_INVALID_OPERATION,
-                  "%s(out of bounds PBO access)", where);
-      return NULL;
+   if (!_mesa_is_bufferobj(unpack->BufferObj)) {
+      /* non-PBO access: no further validation to be done */
+      return ptr;
    }
 
    if (_mesa_bufferobj_mapped(unpack->BufferObj)) {
@@ -236,24 +251,30 @@ _mesa_map_pbo_dest(struct gl_context *ctx,
  */
 GLvoid *
 _mesa_map_validate_pbo_dest(struct gl_context *ctx,
-                            GLuint dimensions,
-                            const struct gl_pixelstore_attrib *unpack,
-                            GLsizei width, GLsizei height, GLsizei depth,
-                            GLenum format, GLenum type, GLvoid *ptr,
-                            const char *where)
+                               GLuint dimensions,
+                               const struct gl_pixelstore_attrib *unpack,
+                               GLsizei width, GLsizei height, GLsizei depth,
+                               GLenum format, GLenum type, GLsizei clientMemSize,
+                               GLvoid *ptr, const char *where)
 {
    ASSERT(dimensions == 1 || dimensions == 2 || dimensions == 3);
 
-   if (!_mesa_is_bufferobj(unpack->BufferObj)) {
-      /* non-PBO access: no validation to be done */
-      return ptr;
+   if (!_mesa_validate_pbo_access(dimensions, unpack, width, height, depth,
+                                  format, type, clientMemSize, ptr)) {
+      if (_mesa_is_bufferobj(unpack->BufferObj)) {
+         _mesa_error(ctx, GL_INVALID_OPERATION,
+                     "%s(out of bounds PBO access)", where);
+      } else {
+         _mesa_error(ctx, GL_INVALID_OPERATION,
+                     "%s(out of bounds access: bufSize (%d) is too small)",
+                     where, clientMemSize);
+      }
+      return NULL;
    }
 
-   if (!_mesa_validate_pbo_access(dimensions, unpack,
-                                  width, height, depth, format, type, ptr)) {
-      _mesa_error(ctx, GL_INVALID_OPERATION,
-                  "%s(out of bounds PBO access)", where);
-      return NULL;
+   if (!_mesa_is_bufferobj(unpack->BufferObj)) {
+      /* non-PBO access: no further validation to be done */
+      return ptr;
    }
 
    if (_mesa_bufferobj_mapped(unpack->BufferObj)) {
@@ -281,7 +302,6 @@ _mesa_unmap_pbo_dest(struct gl_context *ctx,
 }
 
 
-
 /**
  * Check if an unpack PBO is active prior to fetching a texture image.
  * If so, do bounds checking and map the buffer into main memory.
@@ -302,7 +322,7 @@ _mesa_validate_pbo_teximage(struct gl_context *ctx, GLuint dimensions,
       return pixels;
    }
    if (!_mesa_validate_pbo_access(dimensions, unpack, width, height, depth,
-                                  format, type, pixels)) {
+                                     format, type, INT_MAX, pixels)) {
       _mesa_error(ctx, GL_INVALID_OPERATION, funcName, "(invalid PBO access)");
       return NULL;
    }