dri2: Don't crash if the server returns more buffers than expected.
authorEric Anholt <eric@anholt.net>
Sun, 8 Feb 2009 14:26:30 +0000 (15:26 +0100)
committerEric Anholt <eric@anholt.net>
Wed, 11 Feb 2009 02:45:17 +0000 (18:45 -0800)
src/glx/x11/dri2.c

index 3b48cd9c1ca6171a5427f3e4ae07b75d0d187a56..f967432b99435a008a6acb30bf72dedcb8233cbe 100644 (file)
@@ -253,7 +253,7 @@ DRI2Buffer *DRI2GetBuffers(Display *dpy, XID drawable,
     *height = rep.height;
     *outCount = rep.count;
 
-    buffers = Xmalloc(count * sizeof buffers[0]);
+    buffers = Xmalloc(rep.count * sizeof buffers[0]);
     if (buffers == NULL) {
        _XEatData(dpy, rep.count * sizeof repBuffer);
        UnlockDisplay(dpy);