From: Ilia Mirkin <imirkin@alum.mit.edu>
Date: Fri, 5 Feb 2016 05:47:03 +0000 (-0500)
Subject: nvc0: avoid negatives in PUSH_SPACE argument
X-Git-Tag: upstream/17.1.0~12828
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=2065e380b2edafd6e38aa5bb0ff222dc1f6f5ad8;p=platform%2Fupstream%2Fmesa.git

nvc0: avoid negatives in PUSH_SPACE argument

Fixup to commit 03b3eb90d - the number of buffers could be larger than
the number of elements, in which case we'd pass a negative argument to
PUSH_SPACE, which would be bad. While we're at it, merge it with the
other PUSH_SPACE at the top of the function.

Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Cc: mesa-stable@lists.freedesktop.org
---

diff --git a/src/gallium/drivers/nouveau/nvc0/nvc0_vbo.c b/src/gallium/drivers/nouveau/nvc0/nvc0_vbo.c
index f7769da..44aed1a 100644
--- a/src/gallium/drivers/nouveau/nvc0/nvc0_vbo.c
+++ b/src/gallium/drivers/nouveau/nvc0/nvc0_vbo.c
@@ -382,7 +382,7 @@ nvc0_validate_vertex_buffers_shared(struct nvc0_context *nvc0)
    unsigned b;
    const uint32_t mask = nvc0->vbo_user;
 
-   PUSH_SPACE(push, nvc0->num_vtxbufs * 8);
+   PUSH_SPACE(push, nvc0->num_vtxbufs * 8 + nvc0->vertex->num_elements);
    for (b = 0; b < nvc0->num_vtxbufs; ++b) {
       struct pipe_vertex_buffer *vb = &nvc0->vtxbuf[b];
       struct nv04_resource *buf;
@@ -417,7 +417,6 @@ nvc0_validate_vertex_buffers_shared(struct nvc0_context *nvc0)
    /* If there are more elements than buffers, we might not have unset
     * fetching on the later elements.
     */
-   PUSH_SPACE(push, nvc0->vertex->num_elements - b);
    for (; b < nvc0->vertex->num_elements; ++b)
       IMMED_NVC0(push, NVC0_3D(VERTEX_ARRAY_FETCH(b)), 0);