diff options
| author | Jeff Smith <whydoubt@gmail.com> | 2018-02-04 23:17:53 -0600 |
|---|---|---|
| committer | Adam Jackson <ajax@redhat.com> | 2018-02-05 15:40:17 -0500 |
| commit | e81031f3fda0f8b4237224b13c016759eaa52449 (patch) | |
| tree | 918387b37432ebde60fbfcb390188ac5f6888c2e /hw/xfree86/common | |
| parent | 1a24a0ae7b1a7400735530a21ac8c0247723223d (diff) | |
xfree86: Allocate sufficienct space for dev2screen array
When the dev2screen is sized to xf86NumDrivers in DoConfigure(),
subsequent code may attempt to write past the end of the array.
Size the dev2screen array to nDevToConfig instead.
Signed-off-by: Jeff Smith <whydoubt@gmail.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Diffstat (limited to 'hw/xfree86/common')
| -rw-r--r-- | hw/xfree86/common/xf86Configure.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/xfree86/common/xf86Configure.c b/hw/xfree86/common/xf86Configure.c index 672cfd6e8..1b1928b17 100644 --- a/hw/xfree86/common/xf86Configure.c +++ b/hw/xfree86/common/xf86Configure.c @@ -702,7 +702,7 @@ DoConfigure(void) xf86DoConfigurePass1 = FALSE; - dev2screen = xnfcalloc(xf86NumDrivers, sizeof(int)); + dev2screen = xnfcalloc(nDevToConfig, sizeof(int)); { Bool *driverProbed = xnfcalloc(xf86NumDrivers, sizeof(Bool)); |