From 937ad56c261483f2712b61297ee61f6caca35b2a Mon Sep 17 00:00:00 2001 From: Luke Benstead Date: Sat, 29 Feb 2020 09:47:58 +0000 Subject: [PATCH] Fix out of bounds read --- GL/state.c | 2 +- GL/texture.c | 4 +++- containers/named_array.c | 3 +++ 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/GL/state.c b/GL/state.c index 55e2923..f72e78e 100644 --- a/GL/state.c +++ b/GL/state.c @@ -634,7 +634,7 @@ void APIENTRY glGetIntegerv(GLenum pname, GLint *params) { *params = MAX_LIGHTS; break; case GL_TEXTURE_BINDING_2D: - *params = _glGetBoundTexture()->index; + *params = (_glGetBoundTexture()) ? _glGetBoundTexture()->index : 0; break; case GL_DEPTH_FUNC: *params = DEPTH_FUNC; diff --git a/GL/texture.c b/GL/texture.c index e8cdeb9..0ebaeec 100644 --- a/GL/texture.c +++ b/GL/texture.c @@ -371,7 +371,9 @@ void APIENTRY glDeleteTextures(GLsizei n, GLuint *textures) { txr->palette = NULL; } - named_array_release(&TEXTURE_OBJECTS, *textures++); + named_array_release(&TEXTURE_OBJECTS, *textures); + *textures = 0; + textures++; } } diff --git a/containers/named_array.c b/containers/named_array.c index c028e96..a0714bf 100644 --- a/containers/named_array.c +++ b/containers/named_array.c @@ -34,6 +34,9 @@ char named_array_used(NamedArray* array, unsigned int id) { unsigned int i = id / 8; unsigned int j = id % 8; + assert(i < array->max_element_count); + assert(array->used_markers); + unsigned char v = array->used_markers[i] & (unsigned char) (1 << j); return !!(v); }