This fixes a regression caused by a43c21b6bcdda701763afb6d73e38a3c419e54c7 ("DCC: change how fill_bits() marshalls data by reference"). Before the mentioned patch the number of references to Drawable structure were really few so an uint8_t was enough. Now that every chunk of the image are accounted you can easily get an overflow. This fixes https://bugs.freedesktop.org/show_bug.cgi?id=99258. Signed-off-by: Frediano Ziglio <fziglio@xxxxxxxxxx> --- server/display-channel.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/display-channel.h b/server/display-channel.h index 715ad1a..5ecc5c3 100644 --- a/server/display-channel.h +++ b/server/display-channel.h @@ -81,7 +81,7 @@ typedef struct DependItem { } DependItem; struct Drawable { - uint8_t refs; + uint32_t refs; RingItem surface_list_link; RingItem list_link; DrawItem tree_item; -- 2.9.3 _______________________________________________ Spice-devel mailing list Spice-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/spice-devel