[965] Fix potential segfaults from bad realloc.

C has no order of evaluation restrictions on function arguments, so we
attempted to realloc from new-size to new-size.

1 files changed, 4 insertions, 1 deletions

diff --git a/src/mesa/drivers/dri/i965/brw_vs_tnl.c b/src/mesa/drivers/dri/i965/brw_vs_tnl.c
index 27210d1a374..a777dc5aa19 100644
--- a/src/mesa/drivers/dri/i965/brw_vs_tnl.c
+++ b/src/mesa/drivers/dri/i965/brw_vs_tnl.c
@@ -524,10 +524,13 @@ static void emit_op3fn(struct tnl_program *p,
    GLuint nr = p->program->Base.NumInstructions++;
       
    if (nr >= p->nr_instructions) {
+      int new_nr_instructions = p->nr_instructions * 2;
+
       p->program->Base.Instructions = 
 	 _mesa_realloc(p->program->Base.Instructions,
 		       sizeof(struct prog_instruction) * p->nr_instructions,
-		       sizeof(struct prog_instruction) * (p->nr_instructions *= 2));
+		       sizeof(struct prog_instruction) * new_nr_instructions);
+      p->nr_instructions = new_nr_instructions;
    }
 
    {