diff options
| author | Brian Paul <brianp@vmware.com> | 2013-09-14 10:09:24 -0600 |
|---|---|---|
| committer | Brian Paul <brianp@vmware.com> | 2013-10-01 10:10:01 -0600 |
| commit | 6659131be3bde0505a85e3a7d27382b273822bee (patch) | |
| tree | 6ab95153af4ff5a022262d893b8ba16851569c91 /src/mesa/main/syncobj.c | |
| parent | 755602df12cab123b8927e8d71b199b73e48b71b (diff) | |
| download | external_mesa3d-6659131be3bde0505a85e3a7d27382b273822bee.zip external_mesa3d-6659131be3bde0505a85e3a7d27382b273822bee.tar.gz external_mesa3d-6659131be3bde0505a85e3a7d27382b273822bee.tar.bz2 | |
mesa: check for bufSize > 0 in _mesa_GetSynciv()
The spec doesn't say GL_INVALID_VALUE should be raised for bufSize <= 0.
In any case, memcpy(len < 0) will lead to a crash, so don't allow it.
CC: "9.2" <mesa-stable@lists.freedesktop.org>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
Diffstat (limited to 'src/mesa/main/syncobj.c')
| -rw-r--r-- | src/mesa/main/syncobj.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/mesa/main/syncobj.c b/src/mesa/main/syncobj.c index 27867a1..ad21f3b 100644 --- a/src/mesa/main/syncobj.c +++ b/src/mesa/main/syncobj.c @@ -418,7 +418,7 @@ _mesa_GetSynciv(GLsync sync, GLenum pname, GLsizei bufSize, GLsizei *length, return; } - if (size > 0) { + if (size > 0 && bufSize > 0) { const GLsizei copy_count = MIN2(size, bufSize); memcpy(values, v, sizeof(GLint) * copy_count); |