merge -r 56738:56842 maintenance.

13 files changed, 102 insertions, 116 deletions

diff --git a/indra/llcharacter/llkeyframemotion.cpp b/indra/llcharacter/llkeyframemotion.cpp
index 930deb227c..dae85d3154 100644
--- a/indra/llcharacter/llkeyframemotion.cpp
+++ b/indra/llcharacter/llkeyframemotion.cpp
@@ -1169,14 +1169,11 @@ BOOL LLKeyframeMotion::deserialize(LLDataPacker& dp)
 	//-------------------------------------------------------------------------
 	// get emote (optional)
 	//-------------------------------------------------------------------------
-	char read_string[128];
-	if (!dp.unpackString(read_string, "emote_name"))
+	if (!dp.unpackString(mEmoteName, "emote_name"))
 	{
 		llwarns << "can't read optional_emote_animation" << llendl;
 		return FALSE;
 	}
-	
-	mEmoteName.assign( read_string );
 
 	//-------------------------------------------------------------------------
 	// get loop
@@ -1262,7 +1259,8 @@ BOOL LLKeyframeMotion::deserialize(LLDataPacker& dp)
 	S32 k;
 	for(U32 i=0; i<mJointMotionList->mNumJointMotions; ++i)
 	{
-		if (!dp.unpackString(read_string, "joint_name"))
+		std::string joint_name;
+		if (!dp.unpackString(joint_name, "joint_name"))
 		{
 			llwarns << "can't read joint name" << llendl;
 			return FALSE;
@@ -1271,18 +1269,18 @@ BOOL LLKeyframeMotion::deserialize(LLDataPacker& dp)
 		//---------------------------------------------------------------------
 		// find the corresponding joint
 		//---------------------------------------------------------------------
-		LLJoint *joint = mCharacter->getJoint( read_string );
+		LLJoint *joint = mCharacter->getJoint( joint_name );
 		if (joint)
 		{
-//			llinfos << "  joint: " << read_string << llendl;
+//			llinfos << "  joint: " << joint_name << llendl;
 		}
 		else
 		{
-			llwarns << "joint not found: " << read_string << llendl;
+			llwarns << "joint not found: " << joint_name << llendl;
 			//return FALSE;
 		}
 
-		mJointMotionList->mJointMotionArray[i].mJointName = read_string;
+		mJointMotionList->mJointMotionArray[i].mJointName = joint_name;
 		mJointStates[i].setJoint( joint );
 		mJointStates[i].setUsage( 0 );
 
@@ -1509,13 +1507,16 @@ BOOL LLKeyframeMotion::deserialize(LLDataPacker& dp)
 			}
 			constraintp->mConstraintType = (EConstraintType)byte;
 
-			if (!dp.unpackBinaryDataFixed((unsigned char*)read_string, 16, "source_volume"))
+			const S32 BIN_DATA_LENGTH = 16;
+			U8 bin_data[BIN_DATA_LENGTH];
+			if (!dp.unpackBinaryDataFixed(bin_data, BIN_DATA_LENGTH, "source_volume"))
 			{
 				llwarns << "can't read source volume name" << llendl;
 				return FALSE;
 			}
-			
-			str.assign(read_string);
+
+			bin_data[BIN_DATA_LENGTH-1] = 0; // Ensure null termination
+			str = (char*)bin_data;
 			constraintp->mSourceConstraintVolume = mCharacter->getCollisionVolumeID(str);
 
 			if (!dp.unpackVector3(constraintp->mSourceConstraintOffset, "source_offset"))
@@ -1524,13 +1525,14 @@ BOOL LLKeyframeMotion::deserialize(LLDataPacker& dp)
 				return FALSE;
 			}
 
-			if (!dp.unpackBinaryDataFixed((unsigned char*)read_string, 16, "target_volume"))
+			if (!dp.unpackBinaryDataFixed(bin_data, BIN_DATA_LENGTH, "target_volume"))
 			{
 				llwarns << "can't read target volume name" << llendl;
 				return FALSE;
 			}
 
-			str.assign(read_string);
+			bin_data[BIN_DATA_LENGTH-1] = 0; // Ensure null termination
+			str = (char*)bin_data;
 			if (str == "GROUND")
 			{
 				// constrain to ground
@@ -1589,16 +1591,21 @@ BOOL LLKeyframeMotion::deserialize(LLDataPacker& dp)
 			constraintp->mJointStateIndices = new S32[constraintp->mChainLength + 1];
 			
 			LLJoint* joint = mCharacter->findCollisionVolume(constraintp->mSourceConstraintVolume);
+			// get joint to which this collision volume is attached
 			if (!joint)
 			{
 				return FALSE;
 			}
-
-			// get joint to which this collision volume is attached
-			joint = joint->getParent();
-
 			for (S32 i = 0; i < constraintp->mChainLength + 1; i++)
 			{
+				LLJoint* parent = joint->getParent();
+				if (!parent)
+				{
+					llwarns << "Joint with no parent: " << joint->getName()
+							<< " Emote: " << mEmoteName << llendl;
+					return FALSE;
+				}
+				joint = parent;
 				constraintp->mJointStateIndices[i] = -1;
 				for (U32 j = 0; j < mJointMotionList->mNumJointMotions; j++)
 				{
@@ -1608,7 +1615,6 @@ BOOL LLKeyframeMotion::deserialize(LLDataPacker& dp)
 						break;
 					}
 				}
-				joint = joint->getParent();
 			}
 
 		}
diff --git a/indra/llcharacter/llmultigesture.cpp b/indra/llcharacter/llmultigesture.cpp
index 1e42352d74..accb4ae909 100644
--- a/indra/llcharacter/llmultigesture.cpp
+++ b/indra/llcharacter/llmultigesture.cpp
@@ -136,12 +136,10 @@ BOOL LLMultiGesture::deserialize(LLDataPacker& dp)
 	dp.unpackU8(mKey, "key");
 	dp.unpackU32(mMask, "mask");
 
-	char buffer[256];		/* Flawfinder: ignore */
-	dp.unpackString(buffer, "trigger");
-	mTrigger = buffer;
+	
+	dp.unpackString(mTrigger, "trigger");
 
-	dp.unpackString(buffer, "replace");
-	mReplaceText = buffer;
+	dp.unpackString(mReplaceText, "replace");
 
 	S32 count;
 	dp.unpackS32(count, "step_count");
@@ -256,9 +254,7 @@ BOOL LLGestureStepAnimation::serialize(LLDataPacker& dp) const
 
 BOOL LLGestureStepAnimation::deserialize(LLDataPacker& dp)
 {
-	char buffer[256];		/* Flawfinder: ignore */
-	dp.unpackString(buffer, "anim_name");
-	mAnimName = buffer;
+	dp.unpackString(mAnimName, "anim_name");
 
 	// Apparently an earlier version of the gesture code added \r to the end
 	// of the animation names.  Get rid of it.  JC
@@ -333,9 +329,7 @@ BOOL LLGestureStepSound::serialize(LLDataPacker& dp) const
 
 BOOL LLGestureStepSound::deserialize(LLDataPacker& dp)
 {
-	char buffer[256];		/* Flawfinder: ignore */
-	dp.unpackString(buffer, "sound_name");
-	mSoundName = buffer;
+	dp.unpackString(mSoundName, "sound_name");
 
 	dp.unpackUUID(mSoundAssetID, "asset_id");
 	dp.unpackU32(mFlags, "flags");
@@ -391,9 +385,7 @@ BOOL LLGestureStepChat::serialize(LLDataPacker& dp) const
 
 BOOL LLGestureStepChat::deserialize(LLDataPacker& dp)
 {
-	char buffer[256];		/* Flawfinder: ignore */
-	dp.unpackString(buffer, "chat_text");
-	mChatText = buffer;
+	dp.unpackString(mChatText, "chat_text");
 
 	dp.unpackU32(mFlags, "flags");
 	return TRUE;
diff --git a/indra/llmessage/lldatapacker.cpp b/indra/llmessage/lldatapacker.cpp
index bc9f4f3486..627f77d4d8 100644
--- a/indra/llmessage/lldatapacker.cpp
+++ b/indra/llmessage/lldatapacker.cpp
@@ -165,14 +165,15 @@ BOOL LLDataPackerBinaryBuffer::packString(const char *value, const char *name)
 }
 
 
-BOOL LLDataPackerBinaryBuffer::unpackString(char *value, const char *name)
+BOOL LLDataPackerBinaryBuffer::unpackString(std::string& value, const char *name)
 {
 	BOOL success = TRUE;
 	S32 length = (S32)strlen((char *)mCurBufferp) + 1; /*Flawfinder: ignore*/
 
 	success &= verifyLength(length, name);
 
-	htonmemcpy(value, mCurBufferp, MVT_VARIABLE, length);
+	value = std::string((char*)mCurBufferp); // We already assume NULL termination calling strlen()
+	
 	mCurBufferp += length;
 	return success;
 }
@@ -584,16 +585,16 @@ BOOL LLDataPackerAsciiBuffer::packString(const char *value, const char *name)
 	return success;
 }
 
-BOOL LLDataPackerAsciiBuffer::unpackString(char *value, const char *name)
+BOOL LLDataPackerAsciiBuffer::unpackString(std::string& value, const char *name)
 {
 	BOOL success = TRUE;
 	char valuestr[DP_BUFSIZE]; /*Flawfinder: ignore*/
-	if (!getValueStr(name, valuestr, DP_BUFSIZE))
+	BOOL res = getValueStr(name, valuestr, DP_BUFSIZE); // NULL terminated
+	if (!res) // 
 	{
 		return FALSE;
 	}
-	// XXXCHECK: Can result in buffer overrun. Need to pass in size for "value"
-	strcpy(value, valuestr);		/*Flawfinder: ignore*/
+	value = valuestr;
 	return success;
 }
 
@@ -1312,7 +1313,7 @@ BOOL LLDataPackerAsciiFile::packString(const char *value, const char *name)
 	return success;
 }
 
-BOOL LLDataPackerAsciiFile::unpackString(char *value, const char *name)
+BOOL LLDataPackerAsciiFile::unpackString(std::string& value, const char *name)
 {
 	BOOL success = TRUE;
 	char valuestr[DP_BUFSIZE];	/* Flawfinder: ignore */
@@ -1320,7 +1321,7 @@ BOOL LLDataPackerAsciiFile::unpackString(char *value, const char *name)
 	{
 		return FALSE;
 	}
-	strncpy(value, valuestr,DP_BUFSIZE);
+	value = valuestr;
 	return success;
 }
 
diff --git a/indra/llmessage/lldatapacker.h b/indra/llmessage/lldatapacker.h
index 10ca35d2c7..01c3ebb347 100644
--- a/indra/llmessage/lldatapacker.h
+++ b/indra/llmessage/lldatapacker.h
@@ -32,7 +32,7 @@ public:
 	virtual BOOL		hasNext() const = 0;
 
 	virtual BOOL		packString(const char *value, const char *name) = 0;
-	virtual BOOL		unpackString(char *value, const char *name) = 0;
+	virtual BOOL		unpackString(std::string& value, const char *name) = 0;
 
 	virtual BOOL		packBinaryData(const U8 *value, S32 size, const char *name) = 0;
 	virtual BOOL		unpackBinaryData(U8 *value, S32 &size, const char *name) = 0;
@@ -110,7 +110,7 @@ public:
 	}
 
 	/*virtual*/ BOOL		packString(const char *value, const char *name);
-	/*virtual*/ BOOL		unpackString(char *value, const char *name);
+	/*virtual*/ BOOL		unpackString(std::string& value, const char *name);
 
 	/*virtual*/ BOOL		packBinaryData(const U8 *value, S32 size, const char *name);
 	/*virtual*/ BOOL		unpackBinaryData(U8 *value, S32 &size, const char *name);
@@ -212,7 +212,7 @@ public:
 	}
 
 	/*virtual*/ BOOL		packString(const char *value, const char *name);
-	/*virtual*/ BOOL		unpackString(char *value, const char *name);
+	/*virtual*/ BOOL		unpackString(std::string& value, const char *name);
 
 	/*virtual*/ BOOL		packBinaryData(const U8 *value, S32 size, const char *name);
 	/*virtual*/ BOOL		unpackBinaryData(U8 *value, S32 &size, const char *name);
@@ -341,7 +341,7 @@ public:
 	}
 
 	/*virtual*/ BOOL		packString(const char *value, const char *name);
-	/*virtual*/ BOOL		unpackString(char *value, const char *name);
+	/*virtual*/ BOOL		unpackString(std::string& value, const char *name);
 
 	/*virtual*/ BOOL		packBinaryData(const U8 *value, S32 size, const char *name);
 	/*virtual*/ BOOL		unpackBinaryData(U8 *value, S32 &size, const char *name);
diff --git a/indra/llmessage/lltransfersourcefile.cpp b/indra/llmessage/lltransfersourcefile.cpp
index c1df0f25aa..0d58bf7917 100644
--- a/indra/llmessage/lltransfersourcefile.cpp
+++ b/indra/llmessage/lltransfersourcefile.cpp
@@ -144,9 +144,7 @@ void LLTransferSourceParamsFile::packParams(LLDataPacker &dp) const
 
 BOOL LLTransferSourceParamsFile::unpackParams(LLDataPacker &dp)
 {
-	char tmp_str[512];		/* Flawfinder: ignore */
-	dp.unpackString(tmp_str, "Filename");
-	mFilename = tmp_str;
+	dp.unpackString(mFilename, "Filename");
 	U8 delete_flag;
 	dp.unpackU8(delete_flag, "Delete");
 	mDeleteOnCompletion = delete_flag;
diff --git a/indra/lscript/lscript_alloc.h b/indra/lscript/lscript_alloc.h
index f0761c0afd..485a65061a 100644
--- a/indra/lscript/lscript_alloc.h
+++ b/indra/lscript/lscript_alloc.h
@@ -227,7 +227,7 @@ inline LLScriptLibData *lsa_bubble_sort(LLScriptLibData *src, S32 stride, S32 as
 		return retval;
 	}
 
-	LLScriptLibData **sortarray = (LLScriptLibData **)new U32[number];
+	LLScriptLibData **sortarray = new LLScriptLibData*[number];
 
 	LLScriptLibData *temp = src->mListp;
 	while (temp)
@@ -292,7 +292,7 @@ inline LLScriptLibData *lsa_randomize(LLScriptLibData *src, S32 stride)
 		return retval;
 	}
 
-	LLScriptLibData **sortarray = (LLScriptLibData **)new U32[number];
+	LLScriptLibData **sortarray = new LLScriptLibData*[number];
 
 	LLScriptLibData *temp = src->mListp;
 	S32 i = 0;
diff --git a/indra/lscript/lscript_library/lscript_library.cpp b/indra/lscript/lscript_library/lscript_library.cpp
index 2c2cdbabdc..1af10ae9c4 100644
--- a/indra/lscript/lscript_library/lscript_library.cpp
+++ b/indra/lscript/lscript_library/lscript_library.cpp
@@ -448,7 +448,7 @@ LLScriptLibraryFunction::~LLScriptLibraryFunction()
 
 void LLScriptLibrary::addFunction(LLScriptLibraryFunction *func)
 {
-	LLScriptLibraryFunction **temp = (LLScriptLibraryFunction **)new U32[mNextNumber + 1];
+	LLScriptLibraryFunction **temp = new LLScriptLibraryFunction*[mNextNumber + 1];
 	if (mNextNumber)
 	{
 		memcpy(temp, mFunctions, sizeof(LLScriptLibraryFunction *)*mNextNumber);
diff --git a/indra/newview/lltexlayer.cpp b/indra/newview/lltexlayer.cpp
index bc35b90086..33e191cc9c 100644
--- a/indra/newview/lltexlayer.cpp
+++ b/indra/newview/lltexlayer.cpp
@@ -468,7 +468,7 @@ void LLTexLayerSetBuffer::readBackAndUpload(U8* baked_bump_data)
 // static
 void LLTexLayerSetBuffer::onTextureUploadComplete(const LLUUID& uuid, void* userdata, S32 result) // StoreAssetData callback (not fixed)
 {
-	LLBakedUploadData* baked_upload_data = (LLBakedUploadData*)(U32)userdata;
+	LLBakedUploadData* baked_upload_data = (LLBakedUploadData*)userdata;
 
 	LLVOAvatar* avatar = gAgent.getAvatarObject();
 
diff --git a/indra/newview/llviewermenu.cpp b/indra/newview/llviewermenu.cpp
index a899d3d3d2..5ce64156a0 100644
--- a/indra/newview/llviewermenu.cpp
+++ b/indra/newview/llviewermenu.cpp
@@ -1203,7 +1203,7 @@ void init_debug_rendering_menu(LLMenuGL* menu)
 	menu->append(item);
 	
 	
-	item = new LLMenuItemCheckGL("Animate Textures", menu_toggle_control, NULL, menu_check_control, (void*)"AnimateTextures", 'A', MASK_CONTROL|MASK_ALT);
+	item = new LLMenuItemCheckGL("Animate Textures", menu_toggle_control, NULL, menu_check_control, (void*)"AnimateTextures");
 	menu->append(item);
 	
 	item = new LLMenuItemCheckGL("Disable Textures", menu_toggle_variable, NULL, menu_check_variable, (void*)&LLViewerImage::sDontLoadVolumeTextures);
@@ -5006,7 +5006,7 @@ const char* upload_pick(void* data)
 	LLFilePicker::ELoadFilter type;
 	if(data)
 	{
-		type = (LLFilePicker::ELoadFilter)((S32)data);
+		type = (LLFilePicker::ELoadFilter)((intptr_t)data);
 	}
 	else
 	{
@@ -5911,7 +5911,7 @@ void handle_export_selected( void * )
 
 BOOL menu_check_build_tool( void* user_data )
 {
-	S32 index = (S32) user_data;
+	S32 index = (intptr_t) user_data;
 	return gCurrentToolset->isToolSelected( index );
 }
 
@@ -6204,7 +6204,7 @@ class LLObjectEnableSitOrStand : public view_listener_t
 	{
 		bool new_value = false;
 		LLViewerObject* dest_object = NULL;
-		if(dest_object = gObjectList.findObject(gLastHitObjectID))
+		if((dest_object = gObjectList.findObject(gLastHitObjectID)))
 		{
 			if(dest_object->getPCode() == LL_PCODE_VOLUME)
 			{
@@ -8056,7 +8056,7 @@ void handle_debug_avatar_textures(void*)
 
 void handle_grab_texture(void* data)
 {
-	LLVOAvatar::ETextureIndex index = (LLVOAvatar::ETextureIndex) ((U32) data);
+	LLVOAvatar::ETextureIndex index = (LLVOAvatar::ETextureIndex)((intptr_t)data);
 	LLVOAvatar* avatar = gAgent.getAvatarObject();
 	if ( avatar )
 	{
@@ -8147,7 +8147,7 @@ void handle_grab_texture(void* data)
 
 BOOL enable_grab_texture(void* data)
 {
-	LLVOAvatar::ETextureIndex index = (LLVOAvatar::ETextureIndex) ((U32) data);
+	LLVOAvatar::ETextureIndex index = (LLVOAvatar::ETextureIndex)((intptr_t)data);
 	LLVOAvatar* avatar = gAgent.getAvatarObject();
 	if ( avatar )
 	{
@@ -8246,6 +8246,7 @@ BOOL LLViewerMenuHolderGL::hideMenus()
 	}
 	gMenuBarView->clearHoverItem();
 	gMenuBarView->resetMenuTrigger();
+
 	return handled;
 }
 
diff --git a/indra/newview/llviewerobject.cpp b/indra/newview/llviewerobject.cpp
index 7db94eb972..0d1910429e 100644
--- a/indra/newview/llviewerobject.cpp
+++ b/indra/newview/llviewerobject.cpp
@@ -420,38 +420,25 @@ void LLViewerObject::cleanupVOClasses()
 
 // Replaces all name value pairs with data from \n delimited list
 // Does not update server
-void LLViewerObject::setNameValueList(char* name_value_list)
+void LLViewerObject::setNameValueList(const std::string& name_value_list)
 {
 	// Clear out the old
 	for_each(mNameValuePairs.begin(), mNameValuePairs.end(), DeletePairedPointer()) ;
 	mNameValuePairs.clear();
-	
-	// Bring in the new
-	char* token_start = name_value_list;
-	char* scan = name_value_list;
-
-	if (*scan == '\0') return;
 
-	BOOL done = FALSE;
-	while (!done)
+	// Bring in the new
+	std::string::size_type length = name_value_list.length();
+	std::string::size_type start = 0;
+	while (start < length)
 	{
-		while ( (*scan != '\0') && (*scan != '\n') )
-		{
-			scan++;
-		}
-
-		if (*scan == '\n')
-		{
-			*scan = '\0';
-			addNVPair(token_start);
-			scan++;
-			token_start = scan;
-		}
-		else
+		std::string::size_type end = name_value_list.find_first_of("\n", start);
+		if (end == std::string::npos) end = length;
+		if (end > start)
 		{
-			addNVPair(token_start);
-			done = TRUE;
+			std::string tok = name_value_list.substr(start, end - start);
+			addNVPair(tok.c_str());
 		}
+		start = end+1;
 	}
 }
 
@@ -1367,7 +1354,7 @@ U32 LLViewerObject::processUpdateMessage(LLMessageSystem *mesgsys,
 
 				if (value & 0x4)
 				{
-					char temp_string[256];	// not MAX_STRING, must hold 255 chars + \0
+					std::string temp_string;
 					dp->unpackString(temp_string, "Text");
 					LLColor4U coloru;
 					dp->unpackBinaryDataFixed(coloru.mV, 4, "Color");
@@ -1385,12 +1372,8 @@ U32 LLViewerObject::processUpdateMessage(LLMessageSystem *mesgsys,
 
 				if (value & 0x200)
 				{
-					char media_url[MAX_STRING+1];
+					std::string media_url;
 					dp->unpackString(media_url, "MediaURL");
-					//if (media_url[0])
-					//{
-					//	llinfos << "WEBONPRIM media_url " << media_url << llendl;
-					//}
 					if (!mMedia)
 					{
 						retval |= MEDIA_URL_ADDED;
@@ -1461,10 +1444,10 @@ U32 LLViewerObject::processUpdateMessage(LLMessageSystem *mesgsys,
 
 				if (value & 0x100)
 				{
-					char name_value_list[2048];
+					std::string name_value_list;
 					dp->unpackString(name_value_list, "NV");
 
-					setNameValueList(name_value_list);
+					setNameValueList(name_value_list.c_str());
 				}
 
 				mTotalCRC = crc;
@@ -2811,10 +2794,10 @@ void LLViewerObject::decreaseArrowLength()
 }
 
 // Culled from newsim LLTask::addNVPair
-void LLViewerObject::addNVPair(const char* data)
+void LLViewerObject::addNVPair(const std::string& data)
 {
 	// cout << "LLViewerObject::addNVPair() with ---" << data << "---" << endl;
-	LLNameValue *nv = new LLNameValue(data);
+	LLNameValue *nv = new LLNameValue(data.c_str());
 
 //	char splat[MAX_STRING];
 //	temp->printNameValue(splat);
diff --git a/indra/newview/llviewerobject.h b/indra/newview/llviewerobject.h
index 959c44abaa..285d684dc6 100644
--- a/indra/newview/llviewerobject.h
+++ b/indra/newview/llviewerobject.h
@@ -118,7 +118,7 @@ public:
 	static void initVOClasses();
 	static void cleanupVOClasses();
 
-	void			addNVPair(const char* data);
+	void			addNVPair(const std::string& data);
 	BOOL			removeNVPair(const char *name);
 	LLNameValue		*getNVPair(const char *name) const;			// null if no name value pair by that name
 
@@ -519,7 +519,7 @@ protected:
 	void unpackParticleSource(LLDataPacker &dp, const LLUUID& owner_id);
 
 private:
-	void setNameValueList(char* list);		// clears nv pairs and then individually adds \n separated NV pairs from \0 terminated string
+	void setNameValueList(const std::string& list);		// clears nv pairs and then individually adds \n separated NV pairs from \0 terminated string
 	void deleteTEImages(); // correctly deletes list of images
 	
 protected:
diff --git a/indra/newview/llvlcomposition.cpp b/indra/newview/llvlcomposition.cpp
index 841b2cbb47..2127b92c74 100644
--- a/indra/newview/llvlcomposition.cpp
+++ b/indra/newview/llvlcomposition.cpp
@@ -93,6 +93,7 @@ void LLVLComposition::setDetailTextureID(S32 corner, const LLUUID& id)
 		return;
 	}
 	mDetailTextures[corner] = gImageList.getImage(id);
+	mRawImages[corner] = NULL;
 }
 
 BOOL LLVLComposition::generateHeights(const F32 x, const F32 y,
@@ -248,34 +249,37 @@ BOOL LLVLComposition::generateTexture(const F32 x, const F32 y,
 	//
 
 	// These have already been validated by generateComposition.
-	LLPointer<LLImageRaw> st_raw[4];
 	U8* st_data[4];
 
 	for (S32 i = 0; i < 4; i++)
 	{
-		// Read back a raw image for this discard level, if it exists
-		st_raw[i] = new LLImageRaw;
-		S32 min_dim = llmin(mDetailTextures[i]->getWidth(0), mDetailTextures[i]->getHeight(0));
-		S32 ddiscard = 0;
-		while (min_dim > BASE_SIZE && ddiscard < MAX_DISCARD_LEVEL)
+		if (mRawImages[i].isNull())
 		{
-			ddiscard++;
-			min_dim /= 2;
-		}
-		if (!mDetailTextures[i]->readBackRaw(ddiscard, st_raw[i]))
-		{
-			llwarns << "Unable to read raw data for terrain detail texture: " << mDetailTextures[i]->getID() << llendl;
-			return FALSE;
-		}
-		if (mDetailTextures[i]->getWidth(ddiscard) != BASE_SIZE ||
-			mDetailTextures[i]->getHeight(ddiscard) != BASE_SIZE ||
-			mDetailTextures[i]->getComponents() != 3)
-		{
-			LLPointer<LLImageRaw> newraw = new LLImageRaw(BASE_SIZE, BASE_SIZE, 3);
-			newraw->composite(st_raw[i]);
-			st_raw[i] = newraw; // deletes old
+			// Read back a raw image for this discard level, if it exists
+			mRawImages[i] = new LLImageRaw;
+			S32 min_dim = llmin(mDetailTextures[i]->getWidth(0), mDetailTextures[i]->getHeight(0));
+			S32 ddiscard = 0;
+			while (min_dim > BASE_SIZE && ddiscard < MAX_DISCARD_LEVEL)
+			{
+				ddiscard++;
+				min_dim /= 2;
+			}
+			if (!mDetailTextures[i]->readBackRaw(ddiscard, mRawImages[i]))
+			{
+				llwarns << "Unable to read raw data for terrain detail texture: " << mDetailTextures[i]->getID() << llendl;
+				mRawImages[i] = NULL;
+				return FALSE;
+			}
+			if (mDetailTextures[i]->getWidth(ddiscard) != BASE_SIZE ||
+				mDetailTextures[i]->getHeight(ddiscard) != BASE_SIZE ||
+				mDetailTextures[i]->getComponents() != 3)
+			{
+				LLPointer<LLImageRaw> newraw = new LLImageRaw(BASE_SIZE, BASE_SIZE, 3);
+				newraw->composite(mRawImages[i]);
+				mRawImages[i] = newraw; // deletes old
+			}
 		}
-		st_data[i] = st_raw[i]->getData();
+		st_data[i] = mRawImages[i]->getData();
 	}
 
 	///////////////////////////////////////
diff --git a/indra/newview/llvlcomposition.h b/indra/newview/llvlcomposition.h
index 1e929f33dd..35f0ac5879 100644
--- a/indra/newview/llvlcomposition.h
+++ b/indra/newview/llvlcomposition.h
@@ -56,6 +56,7 @@ protected:
 	BOOL mTexturesLoaded;
 
 	LLPointer<LLViewerImage> mDetailTextures[CORNER_COUNT];
+	LLPointer<LLImageRaw> mRawImages[CORNER_COUNT];
 
 	F32 mStartHeight[CORNER_COUNT];
 	F32 mHeightRange[CORNER_COUNT];