TrianglesVisitor: fix buffer overrun

The buffer was of size 3, but the loop statically indexed
up to 5.

Change-Id: Iee81366d8eab548ebaf61704e0bc71a3699617d5
Reviewed-by: Sean Harmer <sean.harmer@kdab.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/src/render/backend/trianglesvisitor.cpp b/src/render/backend/trianglesvisitor.cpp
index 701b4a566..385a302ae 100644
--- a/src/render/backend/trianglesvisitor.cpp
+++ b/src/render/backend/trianglesvisitor.cpp
@@ -277,7 +277,7 @@ void traverseTriangleAdjacencyIndexed(index *indices,
     while (i < indexInfo.count) {
         for (uint u = 0; u < 6; u += 2) {
             uint idx = indices[i + u] * verticesStride;
-            ndx[u] = idx;
+            ndx[u / 2] = idx;
             for (uint j = 0; j < maxVerticesDataSize; ++j) {
                 abc[u / 2][j] = vertices[idx + j];
             }
@@ -303,7 +303,7 @@ void traverseTriangleAdjacency(Vertex *vertices,
     while (i < vertexInfo.count) {
         for (uint u = 0; u < 6; u += 2) {
             uint idx = (i + u) * verticesStride;
-            ndx[u] = idx;
+            ndx[u / 2] = idx;
             for (uint j = 0; j < maxVerticesDataSize; ++j) {
                 abc[u / 2][j] = vertices[idx + j];
             }