xf86RandR12: use correct gamma size when allocating gamma table
When setting crtc->gamma_size to randr_crtc->gammaSize we should use randr_crtc->gammaSize to allocate new gamma table in crtc. Currently, if randr_crtc->gammaSize > crtc->gammaSize the subsequent memcpy will overwrite memory beyond the end of gamma table. Signed-off-by: Dominik Behr <dbehr@chromium.org> Reviewed-by: Stéphane Marchesin <marcheu@chromium.org> Signed-off-by: Keith Packard <keithp@keithp.com>
This commit is contained in:
parent
35d275c751
commit
70e564104b
|
@ -1256,12 +1256,13 @@ xf86RandR12CrtcSetGamma(ScreenPtr pScreen, RRCrtcPtr randr_crtc)
|
||||||
CARD16 *tmp_ptr;
|
CARD16 *tmp_ptr;
|
||||||
|
|
||||||
tmp_ptr =
|
tmp_ptr =
|
||||||
realloc(crtc->gamma_red, 3 * crtc->gamma_size * sizeof(CARD16));
|
realloc(crtc->gamma_red,
|
||||||
|
3 * randr_crtc->gammaSize * sizeof(CARD16));
|
||||||
if (!tmp_ptr)
|
if (!tmp_ptr)
|
||||||
return FALSE;
|
return FALSE;
|
||||||
crtc->gamma_red = tmp_ptr;
|
crtc->gamma_red = tmp_ptr;
|
||||||
crtc->gamma_green = crtc->gamma_red + crtc->gamma_size;
|
crtc->gamma_green = crtc->gamma_red + randr_crtc->gammaSize;
|
||||||
crtc->gamma_blue = crtc->gamma_green + crtc->gamma_size;
|
crtc->gamma_blue = crtc->gamma_green + randr_crtc->gammaSize;
|
||||||
}
|
}
|
||||||
|
|
||||||
crtc->gamma_size = randr_crtc->gammaSize;
|
crtc->gamma_size = randr_crtc->gammaSize;
|
||||||
|
|
Loading…
Reference in New Issue
Block a user