diff options
| author | Eric Anholt <eric@anholt.net> | 2008-01-17 11:25:04 -0800 |
|---|---|---|
| committer | Eric Anholt <eric@anholt.net> | 2008-01-17 11:46:58 -0800 |
| commit | e747e9a072c826f803407c03932adcee7f16cb83 (patch) | |
| tree | 462d22bc1e7fd5fe5c6426f2c759034bb91a4cef /src/mesa/drivers/dri/i965/brw_vs_tnl.c | |
| parent | c9b1fef0c9c5018efd825c42782f19ad0618696a (diff) | |
[965] Fix potential segfaults from bad realloc.
C has no order of evaluation restrictions on function arguments, so we
attempted to realloc from new-size to new-size.
Diffstat (limited to 'src/mesa/drivers/dri/i965/brw_vs_tnl.c')
| -rw-r--r-- | src/mesa/drivers/dri/i965/brw_vs_tnl.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/mesa/drivers/dri/i965/brw_vs_tnl.c b/src/mesa/drivers/dri/i965/brw_vs_tnl.c index 27210d1a37..a777dc5aa1 100644 --- a/src/mesa/drivers/dri/i965/brw_vs_tnl.c +++ b/src/mesa/drivers/dri/i965/brw_vs_tnl.c @@ -524,10 +524,13 @@ static void emit_op3fn(struct tnl_program *p, GLuint nr = p->program->Base.NumInstructions++; if (nr >= p->nr_instructions) { + int new_nr_instructions = p->nr_instructions * 2; + p->program->Base.Instructions = _mesa_realloc(p->program->Base.Instructions, sizeof(struct prog_instruction) * p->nr_instructions, - sizeof(struct prog_instruction) * (p->nr_instructions *= 2)); + sizeof(struct prog_instruction) * new_nr_instructions); + p->nr_instructions = new_nr_instructions; } { |