frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Destroying RandR crtc or output overwrites memory. 

RRCrtcDestroyResource and RROutputDestroyResource had matching
bugs that would overwrite memory past the end of the storage
of the crtc or output arrays. Oops.
(cherry picked from 4202b23ed86405a4cebfdcf239df1b023c1d10ca commit)
This commit is contained in:
Keith Packard 2006-11-27 21:40:24 -08:00 committed by Dave Airlie
parent 23ba72323a
commit 89b2aa9be8
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
randr/rrcrtc.c
View File

@ -344,7 +344,7 @@ RRCrtcDestroyResource (pointer value, XID pid)
if (pScrPriv->crtcs[i] == crtc)
{
memmove (pScrPriv->crtcs + i, pScrPriv->crtcs + i + 1,
(pScrPriv->numCrtcs - (i - 1)) * sizeof (RRCrtcPtr));
(pScrPriv->numCrtcs - (i + 1)) * sizeof (RRCrtcPtr));
--pScrPriv->numCrtcs;
break;
}

2
randr/rroutput.c
View File

@ -327,7 +327,7 @@ RROutputDestroyResource (pointer value, XID pid)
if (pScrPriv->outputs[i] == output)
{
memmove (pScrPriv->outputs + i, pScrPriv->outputs + i + 1,
(pScrPriv->numOutputs - (i - 1)) * sizeof (RROutputPtr));
(pScrPriv->numOutputs - (i + 1)) * sizeof (RROutputPtr));
--pScrPriv->numOutputs;
break;
}