commit 6659131be3bde0505a85e3a7d27382b273822bee
author Brian Paul <brianp@vmware.com> Sat Sep 14 10:09:24 2013 -0600
committer Brian Paul <brianp@vmware.com> Tue Oct 01 10:10:01 2013 -0600
tree 6ab95153af4ff5a022262d893b8ba16851569c91
parent 755602df12cab123b8927e8d71b199b73e48b71b

mesa: check for bufSize > 0 in _mesa_GetSynciv()

The spec doesn't say GL_INVALID_VALUE should be raised for bufSize <= 0.
In any case, memcpy(len < 0) will lead to a crash, so don't allow it.

CC: "9.2" <mesa-stable@lists.freedesktop.org>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>

src/mesa/main/syncobj.c

diff --git a/src/mesa/main/syncobj.c b/src/mesa/main/syncobj.c
index 27867a1..ad21f3b 100644
--- a/src/mesa/main/syncobj.c
+++ b/src/mesa/main/syncobj.c
@@ -418,7 +418,7 @@
       return;
    }
 
-   if (size > 0) {
+   if (size > 0 && bufSize > 0) {
       const GLsizei copy_count = MIN2(size, bufSize);
 
       memcpy(values, v, sizeof(GLint) * copy_count);