Coverity #476: Avoid walking off the end of ->vtx.attrsz, it's declared to

be _TNL_ATTRIB_MAX long so that's not a valid index (woo zero based
indexing).

This code still looks wrong though, the asymmetry between _tnl_copy_to_current
and _tnl_copy_from_current has me worried.

diff --git a/src/mesa/tnl/t_vtx_api.c b/src/mesa/tnl/t_vtx_api.c
index d52d2f7..14a7ab0 100644 (file)
--- a/src/mesa/tnl/t_vtx_api.c
+++ b/src/mesa/tnl/t_vtx_api.c
@@ -194,7 +194,7 @@ static void _tnl_copy_from_current( GLcontext *ctx )
    tnl->vtx.CurrentFloatEdgeFlag = 
       (GLfloat)ctx->Current.EdgeFlag;
    
-   for (i = _TNL_ATTRIB_POS+1 ; i <= _TNL_ATTRIB_MAX ; i++) 
+   for (i = _TNL_ATTRIB_POS+1 ; i < _TNL_ATTRIB_MAX ; i++) 
       switch (tnl->vtx.attrsz[i]) {
       case 4: tnl->vtx.attrptr[i][3] = tnl->vtx.current[i][3];
       case 3: tnl->vtx.attrptr[i][2] = tnl->vtx.current[i][2];