fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2025-12-27 08:10:06 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

glamor: Fix some integer overflow errors.

Browse source 
Imagine a nbox that was (UINT_MAX + small number) / (4 * 2 *
sizeof(float)).  We'd malloc a few bytes after the integer overflow,
but glamor_set_normalize_vcoords would write over gigabytes of heap.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Markus Wick <markus@selfnet.de>
This commit is contained in:
Eric Anholt 2014-01-06 06:55:15 +08:00
parent 20bcda9777
commit 01e30d2043
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
glamor/glamor_fill.c
View file

@ -200,10 +200,10 @@ _glamor_solid_boxes(PixmapPtr pixmap, BoxPtr box, int nbox, float *color)
pixmap_priv_get_dest_scale(pixmap_priv, &xscale, &yscale);
if (nbox * 4 * 2 > ARRAY_SIZE(vertices)) {
if (nbox > valid_nbox) {
int allocated_box;
if (nbox * 6 > GLAMOR_COMPOSITE_VBO_VERT_CNT) {
if (nbox > GLAMOR_COMPOSITE_VBO_VERT_CNT / 6) {
allocated_box = GLAMOR_COMPOSITE_VBO_VERT_CNT / 6;
}
else