Mesa (mesa_7_7_branch): glx: fix incorrect array stack memory allocation
Brian Paul
brianp at kemper.freedesktop.org
Fri Feb 26 17:38:51 UTC 2010
Module: Mesa
Branch: mesa_7_7_branch
Commit: 69334d6784e22b82a0449eab1645ae901c2c6842
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=69334d6784e22b82a0449eab1645ae901c2c6842
Author: Markus Fleschutz <markus.fleschutz at x-software.com>
Date: Fri Feb 26 10:38:21 2010 -0700
glx: fix incorrect array stack memory allocation
The array stack space wasn't allocated to the proper size. Fixes out of
bounds memory writes when the client/array stack depth exceeds one.
See fd.o bug 26768.
---
src/glx/x11/indirect_vertex_array.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/src/glx/x11/indirect_vertex_array.c b/src/glx/x11/indirect_vertex_array.c
index ad98825..ec0e654 100644
--- a/src/glx/x11/indirect_vertex_array.c
+++ b/src/glx/x11/indirect_vertex_array.c
@@ -291,7 +291,8 @@ __glXInitVertexArrayState(__GLXcontext * gc)
arrays->stack_index = 0;
arrays->stack = malloc(sizeof(struct array_stack_state)
- * arrays->num_arrays);
+ * arrays->num_arrays
+ * __GL_CLIENT_ATTRIB_STACK_DEPTH);
}
More information about the mesa-commit
mailing list