andreacavalli/xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

glamor: Fix some integer overflow errors.

Browse Source 
Imagine a nbox that was (UINT_MAX + small number) / (4 * 2 *
sizeof(float)).  We'd malloc a few bytes after the integer overflow,
but glamor_set_normalize_vcoords would write over gigabytes of heap.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Markus Wick <markus@selfnet.de>
This commit is contained in:
Eric Anholt 2014-01-06 06:55:15 +08:00
parent 20bcda9777
commit 01e30d2043
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
glamor/glamor_fill.c
View File

@ -200,10 +200,10 @@ _glamor_solid_boxes(PixmapPtr pixmap, BoxPtr box, int nbox, float *color)
pixmap_priv_get_dest_scale(pixmap_priv, &xscale, &yscale);
if (nbox * 4 * 2 > ARRAY_SIZE(vertices)) {
if (nbox > valid_nbox) {
int allocated_box;
if (nbox * 6 > GLAMOR_COMPOSITE_VBO_VERT_CNT) {
if (nbox > GLAMOR_COMPOSITE_VBO_VERT_CNT / 6) {
allocated_box = GLAMOR_COMPOSITE_VBO_VERT_CNT / 6;
}
else