From f6487e8911399ee62fffd54035c9459256043f9d Mon Sep 17 00:00:00 2001 From: Vinson Lee Date: Fri, 22 Feb 2013 20:33:54 -0800 Subject: [PATCH] vl: Fix off-by-one error in device_name_length allocation. MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Fixes out-of-bounds write reported by Coverity. Signed-off-by: Vinson Lee Reviewed-by: Christian König Reviewed-by: Michel Dänzer --- src/gallium/auxiliary/vl/vl_winsys_dri.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/gallium/auxiliary/vl/vl_winsys_dri.c b/src/gallium/auxiliary/vl/vl_winsys_dri.c index 560c9147683..88e17fefb8a 100644 --- a/src/gallium/auxiliary/vl/vl_winsys_dri.c +++ b/src/gallium/auxiliary/vl/vl_winsys_dri.c @@ -338,9 +338,8 @@ vl_screen_create(Display *display, int screen) goto free_screen; device_name_length = xcb_dri2_connect_device_name_length(connect); - device_name = CALLOC(1, device_name_length); + device_name = CALLOC(1, device_name_length + 1); memcpy(device_name, xcb_dri2_connect_device_name(connect), device_name_length); - device_name[device_name_length] = 0; fd = open(device_name, O_RDWR); free(device_name); -- 2.30.2