As explained in the previous commit, we want to avoid the possibility of
integer-multiplication overflow while allocating buffers.
In these two cases, the final allocation size is the product of three values:
one variable and two that are fixed constants at compile time.
In this commit, we move the explicit multiplication to involve only the
compile-time constants, preventing any overflow from that multiplication, (and
allowing calloc to catch any potential overflow from the remainining implicit
multiplication).
---
src/egl/drivers/dri2/platform_drm.c | 2 +-
src/egl/drivers/dri2/platform_wayland.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/egl/drivers/dri2/platform_drm.c
b/src/egl/drivers/dri2/platform_drm.c
index e272beb..70bd7d4 100644
--- a/src/egl/drivers/dri2/platform_drm.c
+++ b/src/egl/drivers/dri2/platform_drm.c
@@ -352,7 +352,7 @@ dri2_drm_get_buffers(__DRIdrawable * driDrawable,
const unsigned int format = 32;
int i;
- attachments_with_format = calloc(count * 2, sizeof(unsigned int));
+ attachments_with_format = calloc(count, 2 * sizeof(unsigned int));
if (!attachments_with_format) {
*out_count = 0;
return NULL;
diff --git a/src/egl/drivers/dri2/platform_wayland.c
b/src/egl/drivers/dri2/platform_wayland.c
index 537d26e..59b2792 100644
--- a/src/egl/drivers/dri2/platform_wayland.c
+++ b/src/egl/drivers/dri2/platform_wayland.c
@@ -468,7 +468,7 @@ dri2_wl_get_buffers(__DRIdrawable * driDrawable,
const unsigned int format = 32;
int i;
- attachments_with_format = calloc(count * 2, sizeof(unsigned int));
+ attachments_with_format = calloc(count, 2 * sizeof(unsigned int));
if (!attachments_with_format) {
*out_count = 0;
return NULL;
--
2.1.0
_______________________________________________
mesa-dev mailing list
mesa-dev@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/mesa-dev
