[Coverity 1666210] Out-of-bounds read in opengl/sampler.c
Incorrect values read from a different memory region will cause incorrect computations.
In sampler_base_fetch_locations: Out-of-bounds read from a buffer (CWE-125)
4. assignment: Assigning: tex_count = glfmt->tex_count.
279 const unsigned tex_count = glfmt->tex_count;
5. Condition tex_count >= 10, taking false branch.
6. cond_at_most: Checking tex_count >= 10U implies that glfmt->tex_count and tex_count may be up to 9 on the false branch.
280 if (tex_count >= 10)
281 vlc_assert_unreachable();
282
7. Condition i < tex_count, taking true branch.
14. Condition i < tex_count, taking true branch.
15. cond_at_most: Checking i < tex_count implies that i may be up to 8 on the true branch.
283 for (unsigned i = 0; i < tex_count; ++i)
284 {
285 char name[sizeof("Textures[X]")];
286
287 snprintf(name, sizeof(name), "Textures[%1u]", i);
CID 1666214:Out-of-bounds read (OVERRUN) [ "select issue" ]
288 priv->uloc.Textures[i] = vt->GetUniformLocation(program, name);
8. Condition priv->uloc.Textures[i] != -1, taking true branch.
9. Falling through to end of if statement.
16. Condition priv->uloc.Textures[i] != -1, taking true branch.
17. Falling through to end of if statement.
CID 1666214:Out-of-bounds read (OVERRUN) [ "select issue" ]
289 assert(priv->uloc.Textures[i] != -1);
290
10. Condition glfmt->tex_target == 34037, taking true branch.
18. Condition glfmt->tex_target == 34037, taking true branch.
291 if (glfmt->tex_target == GL_TEXTURE_RECTANGLE)
292 {
293 snprintf(name, sizeof(name), "TexSizes[%1u]", i);
CID 1666210:(#1 of 2):Out-of-bounds read (OVERRUN) [ "select issue" ]
294 priv->uloc.TexSizes[i] = vt->GetUniformLocation(program, name);
11. Condition priv->uloc.TexSizes[i] != -1, taking true branch.
12. Falling through to end of if statement.
CID 1666210: (#2 of 2): Out-of-bounds read (OVERRUN)
19. overrun-local: Overrunning array priv->uloc.TexSizes of 5 4-byte elements at element index 8 (byte offset 35) using index i (which evaluates to 8).
295 assert(priv->uloc.TexSizes[i] != -1);
296 }
Not sure where this 10 limit value comes from but it doesn't match with PICTURE_PLANE_MAX
(5)