diff options
| author | qarmin <mikrutrafal54@gmail.com> | 2019-06-09 14:49:59 +0200 |
|---|---|---|
| committer | qarmin <mikrutrafal54@gmail.com> | 2019-06-09 14:49:59 +0200 |
| commit | 99ba021404fa37de5f9a197d52a5fa971c3c05d9 (patch) | |
| tree | 35a07312fc4a1c05db2ec6b7403d8698eda843a6 /drivers | |
| parent | abbbde87e28982150d30e748b89c5303384909ca (diff) | |
Fix invalid crash in mesh_add_surface
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/gles3/rasterizer_storage_gles3.cpp | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/gles3/rasterizer_storage_gles3.cpp b/drivers/gles3/rasterizer_storage_gles3.cpp index 561a3cae2d..01b85458c2 100644 --- a/drivers/gles3/rasterizer_storage_gles3.cpp +++ b/drivers/gles3/rasterizer_storage_gles3.cpp @@ -3501,7 +3501,7 @@ void RasterizerStorageGLES3::mesh_add_surface(RID p_mesh, uint32_t p_format, VS: if (p_vertex_count < (1 << 16)) { //read 16 bit indices const uint16_t *src_idx = (const uint16_t *)ir.ptr(); - for (int i = 0; i < index_count; i += 6) { + for (int i = 0; i + 5 < index_count; i += 6) { wr[i + 0] = src_idx[i / 2]; wr[i + 1] = src_idx[i / 2 + 1]; @@ -3515,7 +3515,7 @@ void RasterizerStorageGLES3::mesh_add_surface(RID p_mesh, uint32_t p_format, VS: //read 16 bit indices const uint32_t *src_idx = (const uint32_t *)ir.ptr(); - for (int i = 0; i < index_count; i += 6) { + for (int i = 0; i + 5 < index_count; i += 6) { wr[i + 0] = src_idx[i / 2]; wr[i + 1] = src_idx[i / 2 + 1]; @@ -3531,7 +3531,7 @@ void RasterizerStorageGLES3::mesh_add_surface(RID p_mesh, uint32_t p_format, VS: index_count = p_vertex_count * 2; wf_indices.resize(index_count); PoolVector<uint32_t>::Write wr = wf_indices.write(); - for (int i = 0; i < index_count; i += 6) { + for (int i = 0; i + 5 < index_count; i += 6) { wr[i + 0] = i / 2; wr[i + 1] = i / 2 + 1; |