From: Nicolai Hähnle <nicolai.haehnle@amd.com>
Date: Fri, 13 May 2016 06:48:04 +0000 (-0500)
Subject: mesa/main: fix integer overflows in _mesa_image_offset
X-Git-Tag: upstream/17.1.0~8729
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=6510e0734563ff8d30e45b8781153367db15cc5b;p=platform%2Fupstream%2Fmesa.git

mesa/main: fix integer overflows in _mesa_image_offset

Found using -fsanitize=undefined.

Cc: "11.1 11.2 12.0" <mesa-stable@lists.freedesktop.org>
Reviewed-by: Brian Paul <brianp@vmware.com>
---

diff --git a/src/mesa/main/image.c b/src/mesa/main/image.c
index 4d6ab6f..a039b51 100644
--- a/src/mesa/main/image.c
+++ b/src/mesa/main/image.c
@@ -151,8 +151,8 @@ _mesa_image_offset( GLuint dimensions,
 
    if (type == GL_BITMAP) {
       /* BITMAP data */
-      GLint bytes_per_row;
-      GLint bytes_per_image;
+      GLintptr bytes_per_row;
+      GLintptr bytes_per_image;
       /* components per pixel for color or stencil index: */
       const GLint comp_per_pixel = 1;
 
@@ -170,8 +170,8 @@ _mesa_image_offset( GLuint dimensions,
    }
    else {
       /* Non-BITMAP data */
-      GLint bytes_per_pixel, bytes_per_row, remainder, bytes_per_image;
-      GLint topOfImage;
+      GLintptr bytes_per_pixel, bytes_per_row, remainder, bytes_per_image;
+      GLintptr topOfImage;
 
       bytes_per_pixel = _mesa_bytes_per_pixel( format, type );