From db79d7dea03d5129a05d48af19049cb740799669 Mon Sep 17 00:00:00 2001
From: Roland Scheidegger <sroland@tungstengraphics.com>
Date: Thu, 25 Jan 2007 14:32:06 +0100
Subject: [PATCH] fix dstelt memory allocation to avoid hash corruption

---
 src/mesa/vbo/vbo_split_copy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/mesa/vbo/vbo_split_copy.c b/src/mesa/vbo/vbo_split_copy.c
index fff733ccb53..df69e4ca28f 100644
--- a/src/mesa/vbo/vbo_split_copy.c
+++ b/src/mesa/vbo/vbo_split_copy.c
@@ -469,7 +469,7 @@ static void replay_init( struct copy_context *copy )
 			    copy->ib->count * 2);
    copy->dstelt_size = MIN2(copy->dstelt_size,
 			    copy->limits->max_indices);
-   copy->dstelt = _mesa_malloc(copy->dstelt_size);
+   copy->dstelt = _mesa_malloc(sizeof(GLuint) * copy->dstelt_size);
    copy->dstelt_nr = 0;
 
    /* Setup the new index buffer to point to the allocated element
-- 
2.30.2