http://bugs.freedesktop.org/show_bug.cgi?id=18445
Brian Paul <[EMAIL PROTECTED]> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
--- Comment #1 from Brian Paul <[EMAIL PROTECTED]> 2008-11-10 13:47:56 PST ---
Nice find. The code in question has been as-is for many years so this goes way
back.
The problem is when the GLX reply is an array, the number of bytes returned is
always a multiple of four. If the 'residences' array isn't a multiple of four
in size, out-of-bounds writes could occur.
The solution is to allocate a temporary buffer which is a multiple of four
bytes when necessary.
I'm about to commit a fix to Mesa for this. Unfortunately, it involves
special-casing the indirect AreTextureResident() function whereas it was
auto-generated before.
--
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Mesa3d-dev mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mesa3d-dev
