File 0007-95e581fd-vrend-fix-oob-read_transfer_data.patch of Package virglrenderer.22702

Index: virglrenderer-0.6.0/src/vrend_renderer.c
===================================================================
--- virglrenderer-0.6.0.orig/src/vrend_renderer.c
+++ virglrenderer-0.6.0/src/vrend_renderer.c
@@ -4668,8 +4668,11 @@ static int vrend_renderer_transfer_write
                                           info->box->height) * elsize;
       if (res->target == GL_TEXTURE_3D ||
           res->target == GL_TEXTURE_2D_ARRAY ||
+          res->target == GL_TEXTURE_2D_MULTISAMPLE_ARRAY ||
           res->target == GL_TEXTURE_CUBE_MAP_ARRAY)
           send_size *= info->box->depth;
+      else if (need_temp && info->box->depth != 1)
+          return EINVAL;
 
       if (need_temp) {
          data = malloc(send_size);