Skip to content

Commit 58b7fe5

Browse files
committed
Avoid potential buffer over-read in shader, overrun in application.
1 parent c4a82fe commit 58b7fe5

File tree

2 files changed

+4
-2
lines changed

2 files changed

+4
-2
lines changed

indra/newview/app_settings/shaders/class1/avatar/objectSkinV.glsl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ mat4 getObjectSkinnedTransform()
3434
vec4 w = fract(weight4);
3535
vec4 index = floor(weight4);
3636

37-
index = min(index, vec4(63.0));
37+
index = min(index, vec4(51.0));
3838
index = max(index, vec4( 0.0));
3939

4040
float scale = 1.0/(w.x+w.y+w.z+w.w);

indra/newview/lldrawpoolavatar.cpp

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1570,7 +1570,9 @@ void LLDrawPoolAvatar::updateRiggedFaceVertexBuffer(LLVOAvatar* avatar, LLFace*
15701570
LLMatrix4a mp[JOINT_COUNT];
15711571
LLMatrix4* mat = (LLMatrix4*) mp;
15721572

1573-
for (U32 j = 0; j < skin->mJointNames.size(); ++j)
1573+
U32 count = llmin((U32) skin->mJointNames.size(), (U32) JOINT_COUNT);
1574+
1575+
for (U32 j = 0; j < count; ++j)
15741576
{
15751577
LLJoint* joint = avatar->getJoint(skin->mJointNames[j]);
15761578
if (joint)

0 commit comments

Comments
 (0)