summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEric Anholt <eric@anholt.net>2008-01-17 11:25:04 -0800
committerEric Anholt <eric@anholt.net>2008-01-17 11:46:58 -0800
commite747e9a072c826f803407c03932adcee7f16cb83 (patch)
tree462d22bc1e7fd5fe5c6426f2c759034bb91a4cef
parentc9b1fef0c9c5018efd825c42782f19ad0618696a (diff)
[965] Fix potential segfaults from bad realloc.
C has no order of evaluation restrictions on function arguments, so we attempted to realloc from new-size to new-size.
-rw-r--r--src/mesa/drivers/dri/i965/brw_vs_tnl.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/src/mesa/drivers/dri/i965/brw_vs_tnl.c b/src/mesa/drivers/dri/i965/brw_vs_tnl.c
index 27210d1a37..a777dc5aa1 100644
--- a/src/mesa/drivers/dri/i965/brw_vs_tnl.c
+++ b/src/mesa/drivers/dri/i965/brw_vs_tnl.c
@@ -524,10 +524,13 @@ static void emit_op3fn(struct tnl_program *p,
GLuint nr = p->program->Base.NumInstructions++;
if (nr >= p->nr_instructions) {
+ int new_nr_instructions = p->nr_instructions * 2;
+
p->program->Base.Instructions =
_mesa_realloc(p->program->Base.Instructions,
sizeof(struct prog_instruction) * p->nr_instructions,
- sizeof(struct prog_instruction) * (p->nr_instructions *= 2));
+ sizeof(struct prog_instruction) * new_nr_instructions);
+ p->nr_instructions = new_nr_instructions;
}
{