[965] Fix potential segfaults from bad realloc.

C has no order of evaluation restrictions on function arguments, so we
attempted to realloc from new-size to new-size.

diff --git a/src/mesa/drivers/dri/i965/brw_vs_tnl.c b/src/mesa/drivers/dri/i965/brw_vs_tnl.c
index 27210d1a3741c44b5bcf8071c122b6177f69538e..a777dc5aa192e04b49155922e3622b6643c33f41 100644 (file)
--- a/src/mesa/drivers/dri/i965/brw_vs_tnl.c
+++ b/src/mesa/drivers/dri/i965/brw_vs_tnl.c
@@ -524,10 +524,13 @@ static void emit_op3fn(struct tnl_program *p,
    GLuint nr = p->program->Base.NumInstructions++;
       
    if (nr >= p->nr_instructions) {
+      int new_nr_instructions = p->nr_instructions * 2;
+
       p->program->Base.Instructions = 
         _mesa_realloc(p->program->Base.Instructions,
                       sizeof(struct prog_instruction) * p->nr_instructions,
-                      sizeof(struct prog_instruction) * (p->nr_instructions *= 2));
+                      sizeof(struct prog_instruction) * new_nr_instructions);
+      p->nr_instructions = new_nr_instructions;
    }
 
    {