Bug #6642: Fix buffer overflow in Render. (CVE 2006-1526, patch from Eric

Anholt)
This commit is contained in:
Adam Jackson 2006-05-02 14:37:49 +00:00
parent 1246fc2eba
commit ba9d2461f9
2 changed files with 8 additions and 2 deletions

View file

@ -1,3 +1,9 @@
2006-05-02 Adam Jackson <ajax@freedesktop.org>
* render/mitri.c:
Bug #6642: Fix buffer overflow in Render. (CVE 2006-1526, patch
from Eric Anholt)
2006-04-28 Adam Jackson <ajax@freedesktop.org>
* configure.ac:

View file

@ -145,7 +145,7 @@ miTriStrip (CARD8 op,
if (npoint < 3)
return;
ntri = npoint - 2;
tris = ALLOCATE_LOCAL (ntri & sizeof (xTriangle));
tris = ALLOCATE_LOCAL (ntri * sizeof (xTriangle));
if (!tris)
return;
for (tri = tris; npoint >= 3; npoint--, points++, tri++)
@ -177,7 +177,7 @@ miTriFan (CARD8 op,
if (npoint < 3)
return;
ntri = npoint - 2;
tris = ALLOCATE_LOCAL (ntri & sizeof (xTriangle));
tris = ALLOCATE_LOCAL (ntri * sizeof (xTriangle));
if (!tris)
return;
first = points++;