Aurelien
/
xf86-video-intel
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sna/glyphs: Fix array allocation for list_extents 

Originally I intended to skip assigning the box on the last list.
However, loop simplicity failed and now we run the risk of writing
beyond the end of stack_extents, and overwriting the list_extents
pointer.

Reported-by: Jiri Slaby <jirislaby@gmail.com>
References: https://bugs.freedesktop.org/show_bug.cgi?id=47597
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
This commit is contained in:
Chris Wilson 2012-07-12 19:39:10 +01:00
parent 0477b5fb6f
commit 32e7f4ee64
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/sna/sna_glyphs.c
View File

@ -1049,8 +1049,8 @@ glyphs_format(int nlist, GlyphListPtr list, GlyphPtr * glyphs)
BoxRec stack_extents[64], *list_extents = stack_extents;
int i, j;
if (nlist > ARRAY_SIZE(stack_extents) + 1) {
list_extents = malloc(sizeof(BoxRec) * (nlist-1));
if (nlist > ARRAY_SIZE(stack_extents)) {
list_extents = malloc(sizeof(BoxRec) * nlist);
if (list_extents == NULL)
return NULL;
}