From 9d9de15a020d317d4486124f97b2cf06b98ee8b6 Mon Sep 17 00:00:00 2001
From: Timothy Arceri <tarceri@itsqueeze.com>
Date: Fri, 12 Nov 2021 19:31:24 +1100
Subject: [PATCH] mesa: fix buffer overrun in SavedObj texture obj array

Fixes: 3be42f9ca19d ("mesa: rewrite glPushAttrib/glPopAttrib to get rid of malloc")

Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/5621

Reviewed-by: Ilia Mirkin <imirkin@alum.mit.edu>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/13773>
---
 src/mesa/main/mtypes.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/mesa/main/mtypes.h b/src/mesa/main/mtypes.h
index 5eb33205fd7..85672a63892 100644
--- a/src/mesa/main/mtypes.h
+++ b/src/mesa/main/mtypes.h
@@ -5158,7 +5158,7 @@ struct gl_texture_attrib_node
    /* For saving per texture object state (wrap modes, filters, etc),
     * SavedObj[][].Target is unused, so the value is invalid.
     */
-   struct gl_texture_object SavedObj[MAX_TEXTURE_UNITS][NUM_TEXTURE_TARGETS];
+   struct gl_texture_object SavedObj[MAX_COMBINED_TEXTURE_IMAGE_UNITS][NUM_TEXTURE_TARGETS];
 };