From 8687ef15a3a1711e0760e59f37c5c39ce9d50aa8 Mon Sep 17 00:00:00 2001 From: David Redondo Date: Fri, 14 Apr 2023 11:47:43 +0200 Subject: [PATCH] egl/wayland: fix oob buffer access during buffer_fds clean up After iterating through the number of planes in the above for loop i is more than the number of planes which corresponds to the size of the buffer_fds array. Fixes: 967b9ad084e ("egl/wayland: for prime, allocate linear_copy from display GPU VRAM") Signed-off-by: David Redondo Reviewed-by: Simon Ser Part-of: (cherry picked from commit eb7e9068865e312a0efb5c863d0d3be6e7571d8d) --- .pick_status.json | 2 +- src/egl/drivers/dri2/platform_wayland.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.pick_status.json b/.pick_status.json index ca6a64dfd4d..f95ffe4bce6 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -598,7 +598,7 @@ "description": "egl/wayland: fix oob buffer access during buffer_fds clean up", "nominated": true, "nomination_type": 1, - "resolution": 0, + "resolution": 1, "main_sha": null, "because_sha": "967b9ad084ecf28f639aeb21b5bdf76813e65a8a" }, diff --git a/src/egl/drivers/dri2/platform_wayland.c b/src/egl/drivers/dri2/platform_wayland.c index fe152294a85..4a896269d0c 100644 --- a/src/egl/drivers/dri2/platform_wayland.c +++ b/src/egl/drivers/dri2/platform_wayland.c @@ -1121,10 +1121,10 @@ get_back_bo(struct dri2_egl_surface *dri2_surf) &strides[0], &offsets[0], dri2_surf->back); - do { + for (i = 0; i < num_planes; ++i) { if (buffer_fds[i] != -1) close(buffer_fds[i]); - } while (--i >= 0); + } dri2_dpy->image->destroyImage(linear_copy_display_gpu_image); } }