Index: api_arrayelt.c
===================================================================
RCS file: /cvs/mesa/Mesa/src/mesa/main/api_arrayelt.c,v
retrieving revision 1.48
diff -u -r1.48 api_arrayelt.c
--- api_arrayelt.c	22 Nov 2006 15:27:58 -0000	1.48
+++ api_arrayelt.c	23 Nov 2006 01:58:48 -0000
@@ -1286,6 +1290,7 @@
       const GLubyte *src
          = ADD_POINTERS(aa->array->BufferObj->Pointer, aa->array->Ptr)
          + elt * aa->array->StrideB;
+      assert(aa->array->_MaxElement >= elt);
       CALL_by_offset( disp, (array_func), aa->offset, 
 		      ((const void *) src) );
    }