fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2026-05-06 20:58:17 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Destroying RandR crtc or output overwrites memory.

Browse source 
RRCrtcDestroyResource and RROutputDestroyResource had matching
bugs that would overwrite memory past the end of the storage
of the crtc or output arrays. Oops.
This commit is contained in:
Keith Packard 2006-11-27 21:40:24 -08:00
parent ec83d67416
commit 4202b23ed8
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
randr/rrcrtc.c
View file

@ -344,7 +344,7 @@ RRCrtcDestroyResource (pointer value, XID pid)
if (pScrPriv->crtcs[i] == crtc)
{
memmove (pScrPriv->crtcs + i, pScrPriv->crtcs + i + 1,
(pScrPriv->numCrtcs - (i - 1)) * sizeof (RRCrtcPtr));
(pScrPriv->numCrtcs - (i + 1)) * sizeof (RRCrtcPtr));
--pScrPriv->numCrtcs;
break;
}

2
randr/rroutput.c
View file

@ -327,7 +327,7 @@ RROutputDestroyResource (pointer value, XID pid)
if (pScrPriv->outputs[i] == output)
{
memmove (pScrPriv->outputs + i, pScrPriv->outputs + i + 1,
(pScrPriv->numOutputs - (i - 1)) * sizeof (RROutputPtr));
(pScrPriv->numOutputs - (i + 1)) * sizeof (RROutputPtr));
--pScrPriv->numOutputs;
break;
}