From 95d05acda511e8559ab87a3d8956ee942ca1999e Mon Sep 17 00:00:00 2001 From: emersion Date: Sun, 2 Sep 2018 09:00:21 +0200 Subject: backend/drm: fix invalid VLA size in scan_drm_connectors I failed to see this issue with Valgrind because of the +1. --- backend/drm/drm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/backend/drm/drm.c b/backend/drm/drm.c index 88055f54..5396dcd4 100644 --- a/backend/drm/drm.c +++ b/backend/drm/drm.c @@ -864,13 +864,13 @@ void scan_drm_connectors(struct wlr_drm_backend *drm) { return; } - size_t drm_outputs_len = wl_list_length(&drm->outputs); + size_t seen_len = wl_list_length(&drm->outputs); // +1 so length can never be 0, which is undefined behaviour. // Last element isn't used. - bool seen[drm_outputs_len + 1]; + bool seen[seen_len + 1]; memset(seen, false, sizeof(seen)); size_t new_outputs_len = 0; - struct wlr_drm_connector *new_outputs[drm_outputs_len + 1]; + struct wlr_drm_connector *new_outputs[res->count_connectors + 1]; for (int i = 0; i < res->count_connectors; ++i) { drmModeConnector *drm_conn = drmModeGetConnector(drm->fd, @@ -998,7 +998,7 @@ void scan_drm_connectors(struct wlr_drm_backend *drm) { size_t index = wl_list_length(&drm->outputs); wl_list_for_each_safe(conn, tmp_conn, &drm->outputs, link) { index--; - if (index >= drm_outputs_len || seen[index]) { + if (index >= seen_len || seen[index]) { continue; } -- cgit v1.2.3