XLibre/xserver
1
1
Fork 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-03-25 12:49:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Destroying RandR crtc or output overwrites memory.

Browse Source 
RRCrtcDestroyResource and RROutputDestroyResource had matching
bugs that would overwrite memory past the end of the storage
of the crtc or output arrays. Oops.
(cherry picked from 4202b23ed86405a4cebfdcf239df1b023c1d10ca commit)
This commit is contained in:
Keith Packard
2006-11-27 21:40:24 -08:00
committed by Dave Airlie
parent 23ba72323a
commit 89b2aa9be8
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
randr/rrcrtc.c
View File

@@ -344,7 +344,7 @@ RRCrtcDestroyResource (pointer value, XID pid)
if (pScrPriv->crtcs[i] == crtc)
{
memmove (pScrPriv->crtcs + i, pScrPriv->crtcs + i + 1,
(pScrPriv->numCrtcs - (i - 1)) * sizeof (RRCrtcPtr));
(pScrPriv->numCrtcs - (i + 1)) * sizeof (RRCrtcPtr));
--pScrPriv->numCrtcs;
break;
}

2
randr/rroutput.c
View File

@@ -327,7 +327,7 @@ RROutputDestroyResource (pointer value, XID pid)
if (pScrPriv->outputs[i] == output)
{
memmove (pScrPriv->outputs + i, pScrPriv->outputs + i + 1,
(pScrPriv->numOutputs - (i - 1)) * sizeof (RROutputPtr));
(pScrPriv->numOutputs - (i + 1)) * sizeof (RROutputPtr));
--pScrPriv->numOutputs;
break;
}