From: Vinson Lee <vlee@freedesktop.org>
Date: Sat, 23 Feb 2013 04:33:54 +0000 (-0800)
Subject: vl: Fix off-by-one error in device_name_length allocation.
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=f6487e8911399ee62fffd54035c9459256043f9d;p=mesa.git

vl: Fix off-by-one error in device_name_length allocation.

Fixes out-of-bounds write reported by Coverity.

Signed-off-by: Vinson Lee <vlee@freedesktop.org>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Michel Dänzer <michel@daenzer.net>
---

diff --git a/src/gallium/auxiliary/vl/vl_winsys_dri.c b/src/gallium/auxiliary/vl/vl_winsys_dri.c
index 560c9147683..88e17fefb8a 100644
--- a/src/gallium/auxiliary/vl/vl_winsys_dri.c
+++ b/src/gallium/auxiliary/vl/vl_winsys_dri.c
@@ -338,9 +338,8 @@ vl_screen_create(Display *display, int screen)
       goto free_screen;
 
    device_name_length = xcb_dri2_connect_device_name_length(connect);
-   device_name = CALLOC(1, device_name_length);
+   device_name = CALLOC(1, device_name_length + 1);
    memcpy(device_name, xcb_dri2_connect_device_name(connect), device_name_length);
-   device_name[device_name_length] = 0;
    fd = open(device_name, O_RDWR);
    free(device_name);