Fix a realloc problem with indirect vertex arrays. The actual head pointer

wasn't tracked and used for the realloc, so it tended to explode.

diff --git a/src/glx/x11/indirect_va_private.h b/src/glx/x11/indirect_va_private.h
index 0b0227f0e287a1f457162ffd16259297e0f3d4d0..ab97dc645fb852253b268fc969d3cb6a29eabddd 100644 (file)
--- a/src/glx/x11/indirect_va_private.h
+++ b/src/glx/x11/indirect_va_private.h
@@ -211,12 +211,14 @@ struct array_state_vector {
      * There are some bytes of extra data before \c array_info_cache that is
      * used to hold the header for RenderLarge commands.  This is
      * \b not included in \c array_info_cache_size or
-     * \c array_info_cache_buffer_size.
+     * \c array_info_cache_buffer_size.  \c array_info_cache_base stores a
+     * pointer to the true start of the buffer (i.e., what malloc returned).
      */
     /*@{*/
     size_t array_info_cache_size;
     size_t array_info_cache_buffer_size;
     void * array_info_cache;
+    void * array_info_cache_base;
     /*@}*/
 
 

diff --git a/src/glx/x11/indirect_vertex_array.c b/src/glx/x11/indirect_vertex_array.c
index d4e6ab99ca99fe2591f26402cac96f71d6b686ef..62a101e665616c264e96b4e61b740a6c7bdd50e0 100644 (file)
--- a/src/glx/x11/indirect_vertex_array.c
+++ b/src/glx/x11/indirect_vertex_array.c
@@ -382,13 +382,14 @@ allocate_array_info_cache( struct array_state_vector * arrays,
 {
 #define MAX_HEADER_SIZE 20
     if ( arrays->array_info_cache_buffer_size < required_size ) {
-       GLubyte * temp = realloc( arrays->array_info_cache, required_size 
-                                 + MAX_HEADER_SIZE );
+       GLubyte * temp = realloc( arrays->array_info_cache_base,
+                                 required_size + MAX_HEADER_SIZE );
 
        if ( temp == NULL ) {
            return GL_FALSE;
        }
 
+       arrays->array_info_cache_base = temp;
        arrays->array_info_cache = temp + MAX_HEADER_SIZE;
        arrays->array_info_cache_buffer_size = required_size;
     }