vl: Fix off-by-one error in device_name_length allocation.

Fixes out-of-bounds write reported by Coverity.

Signed-off-by: Vinson Lee <vlee@freedesktop.org>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Michel Dänzer <michel@daenzer.net>

diff --git a/src/gallium/auxiliary/vl/vl_winsys_dri.c b/src/gallium/auxiliary/vl/vl_winsys_dri.c
index 560c91476831183a7a4fddfd7f047e736c2877aa..88e17fefb8a8c6d5f10bf5ba7b1863b1f5783129 100644 (file)
--- a/src/gallium/auxiliary/vl/vl_winsys_dri.c
+++ b/src/gallium/auxiliary/vl/vl_winsys_dri.c
@@ -338,9 +338,8 @@ vl_screen_create(Display *display, int screen)
       goto free_screen;
 
    device_name_length = xcb_dri2_connect_device_name_length(connect);
-   device_name = CALLOC(1, device_name_length);
+   device_name = CALLOC(1, device_name_length + 1);
    memcpy(device_name, xcb_dri2_connect_device_name(connect), device_name_length);
-   device_name[device_name_length] = 0;
    fd = open(device_name, O_RDWR);
    free(device_name);