[Mesa-dev] [Bug 52059] __indirect_glReadPixels USE_XCB path buffer overflow

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=52059

--- Comment #1 from Julien Cristau <jcristau at debian.org> 2012-07-13 16:23:32 PDT ---
as a PoC, the patch below seems to fix the crashes and valgrind complaints I'd
been seeing.  A real fix would involve glX_proto_send.py.

diff --git a/src/glx/indirect.c b/src/glx/indirect.c
index a6b0c0d..ea0ccf2 100644
--- a/src/glx/indirect.c
+++ b/src/glx/indirect.c
@@ -3756,9 +3756,7 @@ __indirect_glReadPixels(GLint x, GLint y, GLsizei width,
GLsizei height,
                                                           state->storePack.
                                                           swapEndian, 0),
                                       NULL);
-        (void) memcpy(pixels, xcb_glx_read_pixels_data(reply),
-                      xcb_glx_read_pixels_data_length(reply) *
-                      sizeof(GLvoid));
+        __glEmptyImage(gc, 3, width, height, 1, format, type,
xcb_glx_read_pixels_data(reply), pixels);
         free(reply);
 #else
         GLubyte const *pc =

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.