diff options
| author | Eric Anholt <eric@anholt.net> | 2012-05-14 10:18:23 -0700 |
|---|---|---|
| committer | Eric Anholt <eric@anholt.net> | 2012-05-17 10:05:24 -0700 |
| commit | 5a827d9a2b5d698fed98a5d62ff0292b48bdd6c7 (patch) | |
| tree | 59c0e698007f6aa756ec57528afac6b29bf71bb8 | |
| parent | 8b7ba92605c0f21cf6292a1bc2e16e379c0b3be8 (diff) | |
mesa: Check for framebuffer completeness before looking at the rb.
Otherwise, an incomplete framebuffer could have a NULL
_ColorReadBuffer and we'd deref that.
Reviewed-by: Brian Paul <brianp@vmware.com>
Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
| -rw-r--r-- | src/mesa/main/readpix.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/src/mesa/main/readpix.c b/src/mesa/main/readpix.c index 31acfcbf13e..1381110495f 100644 --- a/src/mesa/main/readpix.c +++ b/src/mesa/main/readpix.c @@ -701,6 +701,12 @@ _mesa_ReadnPixelsARB( GLint x, GLint y, GLsizei width, GLsizei height, return; } + if (ctx->ReadBuffer->_Status != GL_FRAMEBUFFER_COMPLETE_EXT) { + _mesa_error(ctx, GL_INVALID_FRAMEBUFFER_OPERATION_EXT, + "glReadPixels(incomplete framebuffer)" ); + return; + } + /* Check that the destination format and source buffer are both * integer-valued or both non-integer-valued. */ @@ -715,12 +721,6 @@ _mesa_ReadnPixelsARB( GLint x, GLint y, GLsizei width, GLsizei height, } } - if (ctx->ReadBuffer->_Status != GL_FRAMEBUFFER_COMPLETE_EXT) { - _mesa_error(ctx, GL_INVALID_FRAMEBUFFER_OPERATION_EXT, - "glReadPixels(incomplete framebuffer)" ); - return; - } - if (ctx->ReadBuffer->Name != 0 && ctx->ReadBuffer->Visual.samples > 0) { _mesa_error(ctx, GL_INVALID_OPERATION, "glReadPixels(multisample FBO)"); return; |