diff options
| author | Eric Anholt <eric@anholt.net> | 2014-02-28 13:02:09 -0500 |
|---|---|---|
| committer | Zhigang Gong <zhigang.gong@gmail.com> | 2014-03-13 21:52:25 +0800 |
| commit | c6a09f7f51a5debb3be43c75e7418a11c33085ea (patch) | |
| tree | a01d604f5ec4b79440189ceb8ca4fbdd46231045 | |
| parent | f674371926323b34a066b01c4fad8a306bfe5717 (diff) | |
glamor: Fix some integer overflow errors.
Imagine a nbox that was (UINT_MAX + small number) / 4 * 2 *
sizeof(float). We'd malloc a few bytes after the integer overflow,
but glamor_set_normalize_vcoords would write over gigabytes of heap.
Ported from Eric's xserver glamor tree.
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
| -rw-r--r-- | src/glamor_fill.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/glamor_fill.c b/src/glamor_fill.c index 4eb23cd..634dbe1 100644 --- a/src/glamor_fill.c +++ b/src/glamor_fill.c @@ -204,10 +204,10 @@ _glamor_solid_boxes(PixmapPtr pixmap, BoxPtr box, int nbox, float *color) pixmap_priv_get_dest_scale(pixmap_priv, &xscale, &yscale); - if (nbox * 4 * 2 > ARRAY_SIZE(vertices)) { + if (nbox > valid_nbox) { int allocated_box; - if (nbox * 6 > GLAMOR_COMPOSITE_VBO_VERT_CNT) { + if (nbox > GLAMOR_COMPOSITE_VBO_VERT_CNT / 6) { allocated_box = GLAMOR_COMPOSITE_VBO_VERT_CNT / 6; } else allocated_box = nbox; |