Browse Source

vl: Fix off-by-one error in device_name_length allocation.

Fixes out-of-bounds write reported by Coverity.

Signed-off-by: Vinson Lee <vlee@freedesktop.org>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Michel Dänzer <michel@daenzer.net>
tags/mesa-9.2-rc1
Vinson Lee 13 years ago
parent
commit
f6487e8911
1 changed files with 1 additions and 2 deletions
  1. 1
    2
      src/gallium/auxiliary/vl/vl_winsys_dri.c

+ 1
- 2
src/gallium/auxiliary/vl/vl_winsys_dri.c View File

@@ -338,9 +338,8 @@ vl_screen_create(Display *display, int screen)
goto free_screen;

device_name_length = xcb_dri2_connect_device_name_length(connect);
device_name = CALLOC(1, device_name_length);
device_name = CALLOC(1, device_name_length + 1);
memcpy(device_name, xcb_dri2_connect_device_name(connect), device_name_length);
device_name[device_name_length] = 0;
fd = open(device_name, O_RDWR);
free(device_name);


Loading…
Cancel
Save