fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-08 06:58:05 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

egl/wayland: fix oob buffer access during buffer_fds clean up

Browse source 
After iterating through the number of planes in the above for
loop i is more than the number of planes which corresponds to
the size of the buffer_fds array.

Fixes: 967b9ad084 ("egl/wayland: for prime, allocate linear_copy from display GPU VRAM")
Signed-off-by: David Redondo <kde@david-redondo.de>
Reviewed-by: Simon Ser <contact@emersion.fr>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/22496>
(cherry picked from commit eb7e906886)
This commit is contained in:
David Redondo 2023-04-14 11:47:43 +02:00 • committed by Eric Engestrom
parent 61cfafda57
commit 8687ef15a3
2 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.pick_status.json
View file

@ -598,7 +598,7 @@
"description": "egl/wayland: fix oob buffer access during buffer_fds clean up",
"nominated": true,
"nomination_type": 1,
"resolution": 0,
"resolution": 1,
"main_sha": null,
"because_sha": "967b9ad084ecf28f639aeb21b5bdf76813e65a8a"
},

4
src/egl/drivers/dri2/platform_wayland.c
View file

@ -1121,10 +1121,10 @@ get_back_bo(struct dri2_egl_surface *dri2_surf)
&strides[0],
&offsets[0],
dri2_surf->back);
do {
for (i = 0; i < num_planes; ++i) {
if (buffer_fds[i] != -1)
close(buffer_fds[i]);
} while (--i >= 0);
}
dri2_dpy->image->destroyImage(linear_copy_display_gpu_image);
}
}