diff options
| author | Brian Starkey <brian.starkey@arm.com> | 2017-02-20 11:02:47 +0000 |
|---|---|---|
| committer | Robert Foss <robert.foss@collabora.com> | 2017-02-21 10:02:23 -0500 |
| commit | c2254c4fa68526760f8c95e72a676a708421da27 (patch) | |
| tree | 9afdf29472f3cc56b118811c8003f56c9f57f3be /lib/igt_kms.c | |
| parent | 45f9bb49b153c0833c088e4fffe7273129fe8715 (diff) | |
lib/igt_kms: Fix memory corruption when there's no cursor plane
The dynamic plane support means that if there's no cursor plane, then
there is no space in the pipe->planes array for it, and thus assigning
a "drm_plane-less" plane is out-of-bounds and leads to heap corruption
and later crashes.
The "drm_plane-less" cursor plane isn't included in n_planes anyway,
which means there's no way to ever access it/know that it's there - so
just remove it entirely.
Fixes: 36656239ef96 lib/igt_kms: Implement dynamic plane count support
Signed-off-by: Brian Starkey <brian.starkey@arm.com>
Reviewed-by: Robert Foss <robert.foss@collabora.com>
Diffstat (limited to 'lib/igt_kms.c')
| -rw-r--r-- | lib/igt_kms.c | 6 |
1 files changed, 0 insertions, 6 deletions
diff --git a/lib/igt_kms.c b/lib/igt_kms.c index 2073a6ac..60c4c260 100644 --- a/lib/igt_kms.c +++ b/lib/igt_kms.c @@ -1692,12 +1692,6 @@ void igt_display_init(igt_display_t *display, int drm_fd) memset(&pipe->planes[last_plane], 0, sizeof *plane); } - } else { - /* Add drm_plane-less cursor */ - plane = &pipe->planes[p]; - plane->pipe = pipe; - plane->index = p; - plane->type = DRM_PLANE_TYPE_CURSOR; } pipe->n_planes = n_planes; |