glx: fix incorrect array stack memory allocation

The array stack space wasn't allocated to the proper size.  Fixes out of
bounds memory writes when the client/array stack depth exceeds one.

See fd.o bug 26768.
This commit is contained in:
Markus Fleschutz 2010-02-26 10:38:21 -07:00 committed by Brian Paul
parent 61482ddc1c
commit 69334d6784

View file

@ -291,7 +291,8 @@ __glXInitVertexArrayState(__GLXcontext * gc)
arrays->stack_index = 0;
arrays->stack = malloc(sizeof(struct array_stack_state)
* arrays->num_arrays);
* arrays->num_arrays
* __GL_CLIENT_ATTRIB_STACK_DEPTH);
}