Fix a realloc problem with indirect vertex arrays. The actual head pointer

wasn't tracked and used for the realloc, so it tended to explode.

2 files changed, 6 insertions, 3 deletions

diff --git a/src/glx/x11/indirect_va_private.h b/src/glx/x11/indirect_va_private.h
index 0b0227f0e2..ab97dc645f 100644
--- a/src/glx/x11/indirect_va_private.h
+++ b/src/glx/x11/indirect_va_private.h
@@ -211,12 +211,14 @@ struct array_state_vector {
      * There are some bytes of extra data before \c array_info_cache that is
      * used to hold the header for RenderLarge commands.  This is
      * \b not included in \c array_info_cache_size or
-     * \c array_info_cache_buffer_size.
+     * \c array_info_cache_buffer_size.  \c array_info_cache_base stores a
+     * pointer to the true start of the buffer (i.e., what malloc returned).
      */
     /*@{*/
     size_t array_info_cache_size;
     size_t array_info_cache_buffer_size;
     void * array_info_cache;
+    void * array_info_cache_base;
     /*@}*/
 
 
diff --git a/src/glx/x11/indirect_vertex_array.c b/src/glx/x11/indirect_vertex_array.c
index d4e6ab99ca..62a101e665 100644
--- a/src/glx/x11/indirect_vertex_array.c
+++ b/src/glx/x11/indirect_vertex_array.c
@@ -382,13 +382,14 @@ allocate_array_info_cache( struct array_state_vector * arrays,
 {
 #define MAX_HEADER_SIZE 20
     if ( arrays->array_info_cache_buffer_size < required_size ) {
-	GLubyte * temp = realloc( arrays->array_info_cache, required_size 
-				  + MAX_HEADER_SIZE );
+	GLubyte * temp = realloc( arrays->array_info_cache_base,
+				  required_size + MAX_HEADER_SIZE );
 
 	if ( temp == NULL ) {
 	    return GL_FALSE;
 	}
 
+	arrays->array_info_cache_base = temp;
 	arrays->array_info_cache = temp + MAX_HEADER_SIZE;
 	arrays->array_info_cache_buffer_size = required_size;
     }