Fix memory accessing overflow

Size of arrays like ctx->gl_tex_2d_state[] should
be assgined to GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS
which is the max number of active textures

Signed-off-by: Zhaowei Yuan <zhaowei.yuan@samsung.com>
Change-Id: Id2512f705beb6fff532c108202910cca24504103

diff --git a/src/modules/fastpath/coregl_fastpath.h b/src/modules/fastpath/coregl_fastpath.h
index 085d2a3..ccc4401 100644 (file)
--- a/src/modules/fastpath/coregl_fastpath.h
+++ b/src/modules/fastpath/coregl_fastpath.h
@@ -50,7 +50,7 @@
 #define FLAG_BIT_6      0x40
 #define FLAG_BIT_7      0x80
 
-#define MAX_TEXTURE_UNITS 32
+#define MAX_TEXTURE_UNITS 96
 #define MAX_VERTEX_ATTRIBS 64
 #define MAX_TRANSFORM_FEEDBACK_SEPARATE_ATTRIBS 64
 #define MAX_UNIFORM_BUFFER_BINDINGS 64

diff --git a/src/modules/fastpath/coregl_fastpath_egl.c b/src/modules/fastpath/coregl_fastpath_egl.c
index dcc3d41..3f7c328 100644 (file)
--- a/src/modules/fastpath/coregl_fastpath_egl.c
+++ b/src/modules/fastpath/coregl_fastpath_egl.c
@@ -515,8 +515,9 @@ _remove_context_ref(GLGlueContext *gctx, Mutex *ctx_list_mtx)
                        free(gctx->real_ctx_sharable_option);
                        gctx->real_ctx_sharable_option = NULL;
                }
+
 # define GLUE_STATE(TYPE, NAME, SIZE, ARRAY_SIZE, DEFAULT_STMT, GET_STMT)  \
-       if (gctx->NAME) free(gctx->NAME);
+       if (gctx->NAME) {free(gctx->NAME); gctx->NAME = NULL;}
 #  include "coregl_fastpath_state.h"
 #undef GLUE_STATE
                free(gctx);

diff --git a/src/modules/fastpath/coregl_fastpath_state.h b/src/modules/fastpath/coregl_fastpath_state.h
index 1304def..275e62f 100644 (file)
--- a/src/modules/fastpath/coregl_fastpath_state.h
+++ b/src/modules/fastpath/coregl_fastpath_state.h
@@ -33,9 +33,9 @@ GLUE_STATE(GLuint, gl_num_draw_buffers, 1, 1,
           _sym_glGetIntegerv(GL_MAX_DRAW_BUFFERS, (GLint *)value);)
 
 GLUE_STATE(GLuint, gl_num_tex_units, 1, 1,
-          _sym_glGetIntegerv(GL_MAX_TEXTURE_IMAGE_UNITS,
+          _sym_glGetIntegerv(GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS,
                              (GLint *)value); /* DEFAULT NOT EFFECT */,
-          _sym_glGetIntegerv(GL_MAX_TEXTURE_IMAGE_UNITS, (GLint *)value);)
+          _sym_glGetIntegerv(GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS, (GLint *)value);)
 
 GLUE_STATE(GLuint, gl_num_vertex_attribs, 1, 1,
           _sym_glGetIntegerv(GL_MAX_VERTEX_ATTRIBS,

diff --git a/src/modules/tracepath/coregl_tracepath.c b/src/modules/tracepath/coregl_tracepath.c
index 6efa10b..120217a 100644 (file)
--- a/src/modules/tracepath/coregl_tracepath.c
+++ b/src/modules/tracepath/coregl_tracepath.c
@@ -455,7 +455,7 @@ tracepath_dump_context_states(int force_output)
 
        _sym_glGetIntegerv(GL_MAX_DRAW_BUFFERS,
                           (GLint *)initial_fake_ctx->gl_num_draw_buffers);
-       _sym_glGetIntegerv(GL_MAX_TEXTURE_IMAGE_UNITS,
+       _sym_glGetIntegerv(GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS,
                           (GLint *)initial_fake_ctx->gl_num_tex_units);
        _sym_glGetIntegerv(GL_MAX_VERTEX_ATTRIBS,
                           (GLint *)initial_fake_ctx->gl_num_vertex_attribs);