As explained in the previous commit, we want to avoid the possibility of integer-multiplication overflow while allocating buffers.
In these two cases, the final allocation size is the product of three values: one variable and two that are fixed constants at compile time. In this commit, we move the explicit multiplication to involve only the compile-time constants, preventing any overflow from that multiplication, (and allowing calloc to catch any potential overflow from the remainining implicit multiplication). --- src/egl/drivers/dri2/platform_drm.c | 2 +- src/egl/drivers/dri2/platform_wayland.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/egl/drivers/dri2/platform_drm.c b/src/egl/drivers/dri2/platform_drm.c index e272beb..70bd7d4 100644 --- a/src/egl/drivers/dri2/platform_drm.c +++ b/src/egl/drivers/dri2/platform_drm.c @@ -352,7 +352,7 @@ dri2_drm_get_buffers(__DRIdrawable * driDrawable, const unsigned int format = 32; int i; - attachments_with_format = calloc(count * 2, sizeof(unsigned int)); + attachments_with_format = calloc(count, 2 * sizeof(unsigned int)); if (!attachments_with_format) { *out_count = 0; return NULL; diff --git a/src/egl/drivers/dri2/platform_wayland.c b/src/egl/drivers/dri2/platform_wayland.c index 537d26e..59b2792 100644 --- a/src/egl/drivers/dri2/platform_wayland.c +++ b/src/egl/drivers/dri2/platform_wayland.c @@ -468,7 +468,7 @@ dri2_wl_get_buffers(__DRIdrawable * driDrawable, const unsigned int format = 32; int i; - attachments_with_format = calloc(count * 2, sizeof(unsigned int)); + attachments_with_format = calloc(count, 2 * sizeof(unsigned int)); if (!attachments_with_format) { *out_count = 0; return NULL; -- 2.1.0 _______________________________________________ mesa-dev mailing list mesa-dev@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/mesa-dev