On Tuesday, 2017-02-07 15:59:32 +0100, Thomas H.P. Andersen wrote:
> On Fri, Feb 3, 2017 at 11:57 AM, Eric Engestrom
> <eric.engestrom@xxxxxxxxxx> wrote:
> >
> > On Thursday, 2017-02-02 23:57:29 +0100, Thomas Hindoe Paaboel Andersen wrote:
> > > Introduced in 028715ee
> > >
> > > Move the dereference after the null check.
> >
> > Fixes: 028715ee707469189505 ("intel: Avoid the need for most overflow
> > checks by using a scratch page.")
> > Reviewed-by: Eric Engestrom <eric.engestrom@xxxxxxxxxx>
>
> Thanks. I do not have commit access. Can I ask you to push it?
I actually don't have commit access to libdrm either :)
Emil, can you push this (and the autogen patches)?
Cheers,
Eric
>
> >
> > > ---
> > > intel/intel_decode.c | 3 ++-
> > > 1 file changed, 2 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/intel/intel_decode.c b/intel/intel_decode.c
> > > index 803d202..2721ffd 100644
> > > --- a/intel/intel_decode.c
> > > +++ b/intel/intel_decode.c
> > > @@ -3899,7 +3899,7 @@ drm_intel_decode(struct drm_intel_decode *ctx)
> > > int ret;
> > > unsigned int index = 0;
> > > uint32_t devid;
> > > - int size = ctx->base_count * 4;
> > > + int size;
> > > void *temp;
> > >
> > > if (!ctx)
> > > @@ -3909,6 +3909,7 @@ drm_intel_decode(struct drm_intel_decode *ctx)
> > > * the batchbuffer. This lets us avoid a bunch of length
> > > * checking in statically sized packets.
> > > */
> > > + size = ctx->base_count * 4;
> > > temp = malloc(size + 4096);
> > > memcpy(temp, ctx->base_data, size);
> > > memset((char *)temp + size, 0xd0, 4096);
> > > --
> > > 2.9.3
> > >
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/dri-devel
