radeon: fix bug in realloc code.
authorDave Airlie <airlied@redhat.com>
Mon, 11 Jan 2010 03:21:02 +0000 (13:21 +1000)
committerDave Airlie <airlied@itt42.(none)>
Mon, 11 Jan 2010 03:24:58 +0000 (13:24 +1000)
This bug was fixed in libdrm ages ago, port to non-kms

src/mesa/drivers/dri/radeon/radeon_cs_legacy.c

index 45b608a1b981959a397c7ad19699dff85b78cd11..bf46eb8aaba9b6a88b248679dc0e9abe3a6b4c35 100644 (file)
@@ -182,7 +182,7 @@ static int cs_begin(struct radeon_cs_int *cs,
         uint32_t tmp, *ptr;
        int num = (ndw > 0x3FF) ? ndw : 0x3FF;
 
-        tmp = (cs->cdw + 1 + num) & (~num);
+        tmp = (cs->cdw + ndw + 0x3ff) & (~0x3ff);
         ptr = (uint32_t*)realloc(cs->packets, 4 * tmp);
         if (ptr == NULL) {
             return -ENOMEM;