From 770ff1cf7071f1e53d7e52df129bdc3ba2099b17 Mon Sep 17 00:00:00 2001
From: Jesse Hall <jessehall@google.com>
Date: Fri, 21 Aug 2015 07:41:46 -0700
Subject: [PATCH] libagl: Fix buffer read overrun in eglCreatePbufferSurface

The code was assuming that EGL_NONE==0, which isn't true.

Bug: 23403170
Change-Id: Ic1eccdef086b4d610bd78dbb6b2ae883c91dc322
---
 opengl/libagl/egl.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/opengl/libagl/egl.cpp b/opengl/libagl/egl.cpp
index 593d0c2d0..ee790c921 100644
--- a/opengl/libagl/egl.cpp
+++ b/opengl/libagl/egl.cpp
@@ -1373,7 +1373,7 @@ static EGLSurface createPbufferSurface(EGLDisplay dpy, EGLConfig config,
 
     int32_t w = 0;
     int32_t h = 0;
-    while (attrib_list[0]) {
+    while (attrib_list[0] != EGL_NONE) {
         if (attrib_list[0] == EGL_WIDTH)  w = attrib_list[1];
         if (attrib_list[0] == EGL_HEIGHT) h = attrib_list[1];
         attrib_list+=2;