fix [2397853] glCopyTexImage2D crashes emulator
Fixed a typo which would cause a buffer overflow
diff --git a/opengl/libagl/texture.cpp b/opengl/libagl/texture.cpp
index 2875c13..fae89b9 100644
--- a/opengl/libagl/texture.cpp
+++ b/opengl/libagl/texture.cpp
@@ -1389,9 +1389,20 @@
// (x,y) is the lower-left corner of colorBuffer
y = cbSurface.height - (y + height);
+ /* The GLES spec says:
+ * If any of the pixels within the specified rectangle are outside
+ * the framebuffer associated with the current rendering context,
+ * then the values obtained for those pixels are undefined.
+ */
+ if (x+width > GLint(cbSurface.width))
+ width = cbSurface.width - x;
+
+ if (y+height > GLint(cbSurface.height))
+ height = cbSurface.height - y;
+
int err = copyPixels(c,
txSurface, 0, 0,
- cbSurface, x, y, cbSurface.width, cbSurface.height);
+ cbSurface, x, y, width, height);
if (err) {
ogles_error(c, err);
}
@@ -1439,6 +1450,17 @@
const GGLSurface& cbSurface = c->rasterizer.state.buffers.color.s;
y = cbSurface.height - (y + height);
+ /* The GLES spec says:
+ * If any of the pixels within the specified rectangle are outside
+ * the framebuffer associated with the current rendering context,
+ * then the values obtained for those pixels are undefined.
+ */
+ if (x+width > GLint(cbSurface.width))
+ width = cbSurface.width - x;
+
+ if (y+height > GLint(cbSurface.height))
+ height = cbSurface.height - y;
+
int err = copyPixels(c,
surface, xoffset, yoffset,
cbSurface, x, y, width, height);