This patch fixes some old memcpy off-by-one errors in vbe.c that gcc-4.5
complains about when compiling with -O1 or higher optimization:
In file included from /usr/include/string.h:642:0,
from vbe.c:16:
In function ‘memcpy’,
inlined from ‘VBEGetModeInfo’ at vbe.c:589:8:
/usr/include/bits/string3.h:52:3: warning: call to __builtin___memcpy_chk will
always overflow destination buffer
In function ‘memcpy’,
inlined from ‘VBEGetModeInfo’ at vbe.c:592:8:
/usr/include/bits/string3.h:52:3: warning: call to __builtin___memcpy_chk will
always overflow destination buffer
X.Org bug 30159 <https://bugs.freedesktop.org/show_bug.cgi?id=30159>
Signed-off-by: Alexandre Rostovtsev <[email protected]>
---
Reserved2 is 189 bytes (not 188). From LinBytesPerScanLine to end of
Reserved2 we have 189 + 16 = 205 bytes (not 206). From PhysBasePtr to end
of Reserved2 we have 189 + 26 = 215 bytes (not 216).
hw/xfree86/vbe/vbe.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/hw/xfree86/vbe/vbe.c b/hw/xfree86/vbe/vbe.c
index 0b34648..2051577 100644
--- a/hw/xfree86/vbe/vbe.c
+++ b/hw/xfree86/vbe/vbe.c
@@ -583,13 +583,13 @@ VBEGetModeInfo(vbeInfoPtr pVbe, int mode)
block->LinRsvdMaskSize = ((char*)pVbe->memory)[60];
block->LinRsvdFieldPosition = ((char*)pVbe->memory)[61];
block->MaxPixelClock = *(CARD32*)(((char*)pVbe->memory) + 62);
- memcpy(&block->Reserved2, ((char*)pVbe->memory) + 66, 188);
+ memcpy(&block->Reserved2, ((char*)pVbe->memory) + 66, 189);
}
else
- memcpy(&block->LinBytesPerScanLine, ((char*)pVbe->memory) + 50, 206);
+ memcpy(&block->LinBytesPerScanLine, ((char*)pVbe->memory) + 50, 205);
}
else
- memcpy(&block->PhysBasePtr, ((char*)pVbe->memory) + 40, 216);
+ memcpy(&block->PhysBasePtr, ((char*)pVbe->memory) + 40, 215);
return block;
}
--
1.7.2.2
_______________________________________________
[email protected]: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: http://lists.x.org/mailman/listinfo/xorg-devel
