diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2009-08-04 20:15:13 +0100 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2009-08-06 10:16:45 +0100 |
| commit | 1327df2cf2f2dd9f98533d824503dfb081803b05 (patch) | |
| tree | 1f07cc722aa90aed1dc17425e5f6a57070315478 /src | |
| parent | 920f59a755ce142b068f21b9db07f76f35449f16 (diff) | |
[pattern] Invalid access beyond end of freed-pool
Oops, we were attempting to return a pointer from beyond the end of our
array.
Diffstat (limited to 'src')
| -rw-r--r-- | src/cairo-pattern.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/cairo-pattern.c b/src/cairo-pattern.c index 6eabaa405..430310634 100644 --- a/src/cairo-pattern.c +++ b/src/cairo-pattern.c @@ -511,7 +511,9 @@ _freed_pattern_put (freed_pool_t *pool, { int i = pool->top; - if (_atomic_store (&pool->pool[i], pattern)) { + if (i < ARRAY_LENGTH (pool->pool) && + _atomic_store (&pool->pool[i], pattern)) + { pool->top = i + 1; return; } |