On Tue, Jul 17, 2018 at 10:12:55PM -0700, Keith Packard wrote:
> Peter Hutterer writes:
>
> > Control flow is:
> >PanoramiXMaybeAddDepth() allocates an array size 240 (pDepth->numVisuals)
> >PanoramiXMaybeAddVisual() finds up to 270 matches (pScreen->numVisuals)
> >and writes those
Peter Hutterer writes:
> Control flow is:
>PanoramiXMaybeAddDepth() allocates an array size 240 (pDepth->numVisuals)
>PanoramiXMaybeAddVisual() finds up to 270 matches (pScreen->numVisuals)
>and writes those into the previously allocated array.
>
> This caused invalid reads/writes
Control flow is:
PanoramiXMaybeAddDepth() allocates an array size 240 (pDepth->numVisuals)
PanoramiXMaybeAddVisual() finds up to 270 matches (pScreen->numVisuals)
and writes those into the previously allocated array.
This caused invalid reads/writes followed by eventually a double-free