Module: Mesa Branch: mesa_7_7_branch Commit: 69334d6784e22b82a0449eab1645ae901c2c6842 URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=69334d6784e22b82a0449eab1645ae901c2c6842
Author: Markus Fleschutz <[email protected]> Date: Fri Feb 26 10:38:21 2010 -0700 glx: fix incorrect array stack memory allocation The array stack space wasn't allocated to the proper size. Fixes out of bounds memory writes when the client/array stack depth exceeds one. See fd.o bug 26768. --- src/glx/x11/indirect_vertex_array.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/glx/x11/indirect_vertex_array.c b/src/glx/x11/indirect_vertex_array.c index ad98825..ec0e654 100644 --- a/src/glx/x11/indirect_vertex_array.c +++ b/src/glx/x11/indirect_vertex_array.c @@ -291,7 +291,8 @@ __glXInitVertexArrayState(__GLXcontext * gc) arrays->stack_index = 0; arrays->stack = malloc(sizeof(struct array_stack_state) - * arrays->num_arrays); + * arrays->num_arrays + * __GL_CLIENT_ATTRIB_STACK_DEPTH); } _______________________________________________ mesa-commit mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/mesa-commit
