Module: Mesa Branch: staging/21.3 Commit: 5275563df4086d85f83cf08b9c4c3e734a49c534 URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=5275563df4086d85f83cf08b9c4c3e734a49c534
Author: Timothy Arceri <[email protected]> Date: Fri Nov 12 19:31:24 2021 +1100 mesa: fix buffer overrun in SavedObj texture obj array Fixes: 3be42f9ca19d ("mesa: rewrite glPushAttrib/glPopAttrib to get rid of malloc") Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/5621 Reviewed-by: Ilia Mirkin <[email protected]> Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/13773> (cherry picked from commit 9d9de15a020d317d4486124f97b2cf06b98ee8b6) --- .pick_status.json | 2 +- src/mesa/main/mtypes.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.pick_status.json b/.pick_status.json index b27a44e6610..6ccaa8e46f8 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -1111,7 +1111,7 @@ "description": "mesa: fix buffer overrun in SavedObj texture obj array", "nominated": true, "nomination_type": 1, - "resolution": 0, + "resolution": 1, "main_sha": null, "because_sha": "3be42f9ca19d593d374d309f47ebd80abb001a24" }, diff --git a/src/mesa/main/mtypes.h b/src/mesa/main/mtypes.h index ca349f4bb47..80715358947 100644 --- a/src/mesa/main/mtypes.h +++ b/src/mesa/main/mtypes.h @@ -5123,7 +5123,7 @@ struct gl_texture_attrib_node /* For saving per texture object state (wrap modes, filters, etc), * SavedObj[][].Target is unused, so the value is invalid. */ - struct gl_texture_object SavedObj[MAX_TEXTURE_UNITS][NUM_TEXTURE_TARGETS]; + struct gl_texture_object SavedObj[MAX_COMBINED_TEXTURE_IMAGE_UNITS][NUM_TEXTURE_TARGETS]; };
