From 7e5bc49d1ed2c78c321da79bdbc99b90c5f95b38 Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Thu, 9 Oct 2014 05:42:08 -0700 Subject: Allocate enough room for both reset & flags attributes ctx_attribs had room for 3 pairs of attributes, but if both flags & reset attributes were being returned it was storing 4 pairs in the array. Found by Coverity #53442: Out-of-bounds write This could cause an immediate crash or incorrect computations. In create_driver_context: Out-of-bounds write to a buffer (CWE-119) Signed-off-by: Alan Coopersmith Reviewed-by: Adam Jackson Signed-off-by: Keith Packard --- glx/glxdri2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/glx/glxdri2.c b/glx/glxdri2.c index c756bf570..5a8966f74 100644 --- a/glx/glxdri2.c +++ b/glx/glxdri2.c @@ -475,7 +475,7 @@ create_driver_context(__GLXDRIcontext * context, context->driContext = NULL; if (screen->dri2->base.version >= 3) { - uint32_t ctx_attribs[3 * 2]; + uint32_t ctx_attribs[4 * 2]; unsigned num_ctx_attribs = 0; unsigned dri_err = 0; unsigned major_ver; @@ -510,6 +510,8 @@ create_driver_context(__GLXDRIcontext * context, __DRI_CTX_ATTRIB_RESET_STRATEGY; ctx_attribs[num_ctx_attribs++] = reset; } + + assert(num_ctx_attribs <= ARRAY_SIZE(ctx_attribs)); } context->driContext = -- cgit v1.2.3