From af16c822a5af8ce0aa7582e8ea44315b62b7356b Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Tue, 8 Dec 2009 18:26:05 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_LightModeli. _mesa_LightModeli calls _mesa_LightModeliv, which uses the params argument as an array. --- src/mesa/main/light.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/mesa/main/light.c') diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c index 10c89f4368..5a8f9160f6 100644 --- a/src/mesa/main/light.c +++ b/src/mesa/main/light.c @@ -537,7 +537,10 @@ _mesa_LightModeliv( GLenum pname, const GLint *params ) void GLAPIENTRY _mesa_LightModeli( GLenum pname, GLint param ) { - _mesa_LightModeliv( pname, ¶m ); + GLint iparam[4]; + iparam[0] = param; + iparam[1] = iparam[2] = iparam[3] = 0; + _mesa_LightModeliv( pname, iparam ); } -- cgit v1.2.3 From 637970aefdcdd1ee50e3759de384b82e6109a45c Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Wed, 9 Dec 2009 12:43:28 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_LightModelf. _mesa_LightModelf calls _mesa_LightModelfv, which uses the params argument as an array. --- src/mesa/main/light.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/mesa/main/light.c') diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c index 5a8f9160f6..c1d47de330 100644 --- a/src/mesa/main/light.c +++ b/src/mesa/main/light.c @@ -547,7 +547,10 @@ _mesa_LightModeli( GLenum pname, GLint param ) void GLAPIENTRY _mesa_LightModelf( GLenum pname, GLfloat param ) { - _mesa_LightModelfv( pname, ¶m ); + GLfloat fparam[4]; + fparam[0] = param; + fparam[1] = fparam[2] = fparam[3] = 0.0F; + _mesa_LightModelfv( pname, fparam ); } -- cgit v1.2.3 From 34528a34c446afea4442f479713e7f926220f128 Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Wed, 9 Dec 2009 17:11:30 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_Lightf. --- src/mesa/main/light.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/mesa/main/light.c') diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c index c1d47de330..d4f3bb9026 100644 --- a/src/mesa/main/light.c +++ b/src/mesa/main/light.c @@ -206,7 +206,10 @@ _mesa_light(GLcontext *ctx, GLuint lnum, GLenum pname, const GLfloat *params) void GLAPIENTRY _mesa_Lightf( GLenum light, GLenum pname, GLfloat param ) { - _mesa_Lightfv( light, pname, ¶m ); + GLfloat fparam[4]; + fparam[0] = param; + fparam[1] = fparam[2] = fparam[3] = 0.0F; + _mesa_Lightfv( light, pname, fparam ); } -- cgit v1.2.3 From 444d1f39108ab4419843f19f76c968cef3398bab Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Wed, 9 Dec 2009 17:34:50 -0800 Subject: mesa: Fix array out-of-bounds access by _mesa_Lighti. _mesa_Lighti calls _mesa_Lightiv, which uses the params argument as an array. --- src/mesa/main/light.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/mesa/main/light.c') diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c index d4f3bb9026..5150926159 100644 --- a/src/mesa/main/light.c +++ b/src/mesa/main/light.c @@ -288,7 +288,10 @@ _mesa_Lightfv( GLenum light, GLenum pname, const GLfloat *params ) void GLAPIENTRY _mesa_Lighti( GLenum light, GLenum pname, GLint param ) { - _mesa_Lightiv( light, pname, ¶m ); + GLint iparam[4]; + iparam[0] = param; + iparam[1] = iparam[2] = iparam[3] = 0; + _mesa_Lightiv( light, pname, iparam ); } -- cgit v1.2.3