diff options
| author | Matthieu Herrb <matthieu@cvs.openbsd.org> | 2008-04-17 21:21:28 +0000 |
|---|---|---|
| committer | Matthieu Herrb <matthieu@cvs.openbsd.org> | 2008-04-17 21:21:28 +0000 |
| commit | bdbc34ef07ef92673f9ff4a564b732cc827efd6e (patch) | |
| tree | aabdb532c72b00cb9bac60e5ab3d1d858615a72b /dist/Mesa/src | |
| parent | ff51d7fb60a829ef159389920e7c1b8c07012a5a (diff) | |
Fix from Eric Anholt in Mesa-current:
[965] Fix potential segfaults from bad realloc.
C has no order of evaluation restrictions on function arguments, so we
attempted to realloc from new-size to new-size.
Diffstat (limited to 'dist/Mesa/src')
| -rw-r--r-- | dist/Mesa/src/mesa/drivers/dri/i965/brw_vs_tnl.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/dist/Mesa/src/mesa/drivers/dri/i965/brw_vs_tnl.c b/dist/Mesa/src/mesa/drivers/dri/i965/brw_vs_tnl.c index 14483b325..c4e805d92 100644 --- a/dist/Mesa/src/mesa/drivers/dri/i965/brw_vs_tnl.c +++ b/dist/Mesa/src/mesa/drivers/dri/i965/brw_vs_tnl.c @@ -524,10 +524,13 @@ static void emit_op3fn(struct tnl_program *p, GLuint nr = p->program->Base.NumInstructions++; if (nr >= p->nr_instructions) { + int new_nr_instructions = p->nr_instructions * 2; + p->program->Base.Instructions = _mesa_realloc(p->program->Base.Instructions, sizeof(struct prog_instruction) * p->nr_instructions, - sizeof(struct prog_instruction) * (p->nr_instructions *= 2)); + sizeof(struct prog_instruction) * new_nr_instructions); + p->nr_instructions = new_nr_instructions; } { |