diff options
| author | Vinson Lee <[email protected]> | 2013-02-22 20:33:54 -0800 |
|---|---|---|
| committer | Vinson Lee <[email protected]> | 2013-02-23 14:57:05 -0800 |
| commit | f6487e8911399ee62fffd54035c9459256043f9d (patch) | |
| tree | 3af5a4abb662baba4fd6b563bc0875704499ceeb | |
| parent | 65aa1a194d703664d2f68e2e6fd69029298ae25a (diff) | |
vl: Fix off-by-one error in device_name_length allocation.
Fixes out-of-bounds write reported by Coverity.
Signed-off-by: Vinson Lee <[email protected]>
Reviewed-by: Christian König <[email protected]>
Reviewed-by: Michel Dänzer <[email protected]>
| -rw-r--r-- | src/gallium/auxiliary/vl/vl_winsys_dri.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/src/gallium/auxiliary/vl/vl_winsys_dri.c b/src/gallium/auxiliary/vl/vl_winsys_dri.c index 560c9147683..88e17fefb8a 100644 --- a/src/gallium/auxiliary/vl/vl_winsys_dri.c +++ b/src/gallium/auxiliary/vl/vl_winsys_dri.c @@ -338,9 +338,8 @@ vl_screen_create(Display *display, int screen) goto free_screen; device_name_length = xcb_dri2_connect_device_name_length(connect); - device_name = CALLOC(1, device_name_length); + device_name = CALLOC(1, device_name_length + 1); memcpy(device_name, xcb_dri2_connect_device_name(connect), device_name_length); - device_name[device_name_length] = 0; fd = open(device_name, O_RDWR); free(device_name); |