diff options
| author | Xiang, Haihao <haihao.xiang@intel.com> | 2018-03-13 12:50:50 +0800 |
|---|---|---|
| committer | Xiang, Haihao <haihao.xiang@intel.com> | 2018-03-14 23:12:08 +0800 |
| commit | 7ce5277537c1e278dd8267f8b934bbfebd2fefe8 (patch) | |
| tree | ae90360b251b8a1828ce5548e91efffb8bd9bde4 | |
| parent | 555cd80a64ebf72d75c3bc9dbee6e05f2f03cca6 (diff) | |
| download | libva-intel-driver-7ce5277537c1e278dd8267f8b934bbfebd2fefe8.tar.gz | |
Correct the valid buffer size
Otherwise it might result in out-of-bounds access of i965->va_vendor
Signed-off-by: Xiang, Haihao <haihao.xiang@intel.com>
| -rw-r--r-- | src/i965_drv_video.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/i965_drv_video.c b/src/i965_drv_video.c index 36719e87..f66973fe 100644 --- a/src/i965_drv_video.c +++ b/src/i965_drv_video.c @@ -7346,13 +7346,13 @@ ensure_vendor_string(struct i965_driver_data *i965, const char *chipset) if (INTEL_DRIVER_PRE_VERSION > 0) { ret = snprintf(&i965->va_vendor[len], sizeof(i965->va_vendor) - len, ".pre%d", INTEL_DRIVER_PRE_VERSION); - if (ret < 0 || ret >= sizeof(i965->va_vendor)) + if (ret < 0 || ret >= (sizeof(i965->va_vendor) - len)) goto error; len += ret; ret = snprintf(&i965->va_vendor[len], sizeof(i965->va_vendor) - len, " (%s)", INTEL_DRIVER_GIT_VERSION); - if (ret < 0 || ret >= sizeof(i965->va_vendor)) + if (ret < 0 || ret >= (sizeof(i965->va_vendor) - len)) goto error; len += ret; } |