From: Eric Anholt <eric@anholt.net>
Date: Thu, 17 Jan 2008 19:25:04 +0000 (-0800)
Subject: [965] Fix potential segfaults from bad realloc.
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=e747e9a072c826f803407c03932adcee7f16cb83;p=mesa.git

[965] Fix potential segfaults from bad realloc.

C has no order of evaluation restrictions on function arguments, so we
attempted to realloc from new-size to new-size.
---

diff --git a/src/mesa/drivers/dri/i965/brw_vs_tnl.c b/src/mesa/drivers/dri/i965/brw_vs_tnl.c
index 27210d1a374..a777dc5aa19 100644
--- a/src/mesa/drivers/dri/i965/brw_vs_tnl.c
+++ b/src/mesa/drivers/dri/i965/brw_vs_tnl.c
@@ -524,10 +524,13 @@ static void emit_op3fn(struct tnl_program *p,
    GLuint nr = p->program->Base.NumInstructions++;
       
    if (nr >= p->nr_instructions) {
+      int new_nr_instructions = p->nr_instructions * 2;
+
       p->program->Base.Instructions = 
 	 _mesa_realloc(p->program->Base.Instructions,
 		       sizeof(struct prog_instruction) * p->nr_instructions,
-		       sizeof(struct prog_instruction) * (p->nr_instructions *= 2));
+		       sizeof(struct prog_instruction) * new_nr_instructions);
+      p->nr_instructions = new_nr_instructions;
    }
 
    {