From e747e9a072c826f803407c03932adcee7f16cb83 Mon Sep 17 00:00:00 2001 From: Eric Anholt Date: Thu, 17 Jan 2008 11:25:04 -0800 Subject: [965] Fix potential segfaults from bad realloc. C has no order of evaluation restrictions on function arguments, so we attempted to realloc from new-size to new-size. --- src/mesa/drivers/dri/i965/brw_vs_tnl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/mesa/drivers/dri') diff --git a/src/mesa/drivers/dri/i965/brw_vs_tnl.c b/src/mesa/drivers/dri/i965/brw_vs_tnl.c index 27210d1a374..a777dc5aa19 100644 --- a/src/mesa/drivers/dri/i965/brw_vs_tnl.c +++ b/src/mesa/drivers/dri/i965/brw_vs_tnl.c @@ -524,10 +524,13 @@ static void emit_op3fn(struct tnl_program *p, GLuint nr = p->program->Base.NumInstructions++; if (nr >= p->nr_instructions) { + int new_nr_instructions = p->nr_instructions * 2; + p->program->Base.Instructions = _mesa_realloc(p->program->Base.Instructions, sizeof(struct prog_instruction) * p->nr_instructions, - sizeof(struct prog_instruction) * (p->nr_instructions *= 2)); + sizeof(struct prog_instruction) * new_nr_instructions); + p->nr_instructions = new_nr_instructions; } { -- cgit v1.2.3