summaryrefslogtreecommitdiffstats
path: root/src/mesa/drivers/dri/common/utils.c
diff options
context:
space:
mode:
authorCarl Worth <cworth@cworth.org>2014-09-03 14:18:18 -0700
committerCarl Worth <cworth@cworth.org>2014-09-03 18:37:02 -0700
commitc35f14f36880eb20f5e54480444e343520e9bec5 (patch)
tree860639f711be92e6ee031b005ac0284320c91d39 /src/mesa/drivers/dri/common/utils.c
parent96ce065db46d11f5ad6423f4a522f3e92153b3cf (diff)
Eliminate several cases of multiplication in arguments to calloc
In commit 32f2fd1c5d6088692551c80352b7d6fa35b0cd09, several calls to _mesa_calloc(x) were replaced with calls to calloc(1, x). This is strictly equivalent to what the code was doing previously. But for cases where "x" involves multiplication, now that we are explicitly using the two-argument calloc, we can do one step better and replace: calloc(1, A * B); with: calloc(A, B); The advantage of the latter is that calloc will detect any overflow that would have resulted from the multiplication and will fail the allocation, (whereas the former would return a small allocation). So this fix can change potentially exploitable buffer overruns into segmentation faults. Reviewed-by: Matt Turner <mattst88@gmail.com>
Diffstat (limited to 'src/mesa/drivers/dri/common/utils.c')
-rw-r--r--src/mesa/drivers/dri/common/utils.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/mesa/drivers/dri/common/utils.c b/src/mesa/drivers/dri/common/utils.c
index e0b3db8cf14..f2e63c0b98c 100644
--- a/src/mesa/drivers/dri/common/utils.c
+++ b/src/mesa/drivers/dri/common/utils.c
@@ -238,7 +238,7 @@ driCreateConfigs(mesa_format format,
is_srgb = _mesa_get_format_color_encoding(format) == GL_SRGB;
num_modes = num_depth_stencil_bits * num_db_modes * num_accum_bits * num_msaa_modes;
- configs = calloc(1, (num_modes + 1) * sizeof *configs);
+ configs = calloc(num_modes + 1, sizeof *configs);
if (configs == NULL)
return NULL;