glamor: Fix some integer overflow errors.
Imagine a nbox that was (UINT_MAX + small number) / (4 * 2 * sizeof(float)). We'd malloc a few bytes after the integer overflow, but glamor_set_normalize_vcoords would write over gigabytes of heap. Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Markus Wick <markus@selfnet.de>
This commit is contained in:
parent
20bcda9777
commit
01e30d2043
|
@ -200,10 +200,10 @@ _glamor_solid_boxes(PixmapPtr pixmap, BoxPtr box, int nbox, float *color)
|
|||
|
||||
pixmap_priv_get_dest_scale(pixmap_priv, &xscale, &yscale);
|
||||
|
||||
if (nbox * 4 * 2 > ARRAY_SIZE(vertices)) {
|
||||
if (nbox > valid_nbox) {
|
||||
int allocated_box;
|
||||
|
||||
if (nbox * 6 > GLAMOR_COMPOSITE_VBO_VERT_CNT) {
|
||||
if (nbox > GLAMOR_COMPOSITE_VBO_VERT_CNT / 6) {
|
||||
allocated_box = GLAMOR_COMPOSITE_VBO_VERT_CNT / 6;
|
||||
}
|
||||
else
|
||||
|
|
Loading…
Reference in New Issue
Block a user