Fix segfault in glDrawElements when count == 0
If count is zero, a nonzero count might get mistakenly passed to
sendVertexAttributes, due to different logic used to arrive at counts
when index buffers are involved. Once the nonzero count is passed to
sendVertexAttributes when count == 0 for the call to glDrawElements,
there is a potential read access violation when we deliver the vertex
attributes.
Test: Run dEQP-GLES3.functional.primitive_restart.* on host with
goldfish-openg; ASAN does not abort.
Test: Run aosp master cts mustpass on dEQP-EGL, GLES3 to check regressions; all still pass on nvidia
Change-Id: Iedf2b1acb27a4dce00e74ee2227e344037382df1
diff --git a/system/GLESv2_enc/GL2Encoder.cpp b/system/GLESv2_enc/GL2Encoder.cpp
index 0217ff0..4fc1765 100755
--- a/system/GLESv2_enc/GL2Encoder.cpp
+++ b/system/GLESv2_enc/GL2Encoder.cpp
@@ -1255,6 +1255,8 @@
&maxIndex);
}
+ if (count == 0) return;
+
bool adjustIndices = true;
if (ctx->m_state->currentIndexVbo() != 0) {
if (!has_client_vertex_arrays) {
@@ -3864,6 +3866,8 @@
&maxIndex);
}
+ if (count == 0) return;
+
bool adjustIndices = true;
if (ctx->m_state->currentIndexVbo() != 0) {
if (!has_client_vertex_arrays) {
@@ -3955,6 +3959,8 @@
&maxIndex);
}
+ if (count == 0) return;
+
bool adjustIndices = true;
if (ctx->m_state->currentIndexVbo() != 0) {
if (!has_client_vertex_arrays) {
