mesa: Fix array out-of-bounds access by _mesa_LightModelf.

_mesa_LightModelf calls _mesa_LightModelfv, which uses the
params argument as an array.

diff --git a/src/mesa/main/light.c b/src/mesa/main/light.c
index 5a8f916..c1d47de 100644 (file)
--- a/src/mesa/main/light.c
+++ b/src/mesa/main/light.c
@@ -547,7 +547,10 @@ _mesa_LightModeli( GLenum pname, GLint param )
 void GLAPIENTRY
 _mesa_LightModelf( GLenum pname, GLfloat param )
 {
-   _mesa_LightModelfv( pname, &param );
+   GLfloat fparam[4];
+   fparam[0] = param;
+   fparam[1] = fparam[2] = fparam[3] = 0.0F;
+   _mesa_LightModelfv( pname, fparam );
 }