andreacavalli/xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Destroying RandR crtc or output overwrites memory.

Browse Source 
RRCrtcDestroyResource and RROutputDestroyResource had matching
bugs that would overwrite memory past the end of the storage
of the crtc or output arrays. Oops.
(cherry picked from 4202b23ed8 commit)
This commit is contained in:
Keith Packard 2006-11-27 21:40:24 -08:00 committed by Dave Airlie
parent 23ba72323a
commit 89b2aa9be8
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
randr/rrcrtc.c
View File

@ -344,7 +344,7 @@ RRCrtcDestroyResource (pointer value, XID pid)
if (pScrPriv->crtcs[i] == crtc)
{
memmove (pScrPriv->crtcs + i, pScrPriv->crtcs + i + 1,
(pScrPriv->numCrtcs - (i - 1)) * sizeof (RRCrtcPtr));
(pScrPriv->numCrtcs - (i + 1)) * sizeof (RRCrtcPtr));
--pScrPriv->numCrtcs;
break;
}

2
randr/rroutput.c
View File

@ -327,7 +327,7 @@ RROutputDestroyResource (pointer value, XID pid)
if (pScrPriv->outputs[i] == output)
{
memmove (pScrPriv->outputs + i, pScrPriv->outputs + i + 1,
(pScrPriv->numOutputs - (i - 1)) * sizeof (RROutputPtr));
(pScrPriv->numOutputs - (i + 1)) * sizeof (RROutputPtr));
--pScrPriv->numOutputs;
break;
}