On Tue, 2016-05-17 at 08:35 +0200, Jiri Slaby wrote:
> Bounds of screen are 0 (inclusive) and ScreenCount(dpy) (exclusive).
> The upper bound was too ScreenCount(dpy) (inclusive).
> 
> This causes a crash invoked by java3d which passes down an invalid
> screen:
> 6  0x00007f0e5198ba70 in  () at /lib64/libc.so.6
> 7  0x00007f0e14531e14 in glXGetFBConfigs (dpy=, screen=1, 
> nelements=nelements@entry=0x7f0dab3c522c) at glxcmds.c:1660
> 8  0x00007f0e14532f7f in glXChooseFBConfig (dpy=, screen=, 
> attribList=0x7f0dab3c54e0, nitems=0x7f0dab3c535c) at glxcmds.c:1611
> 9  0x00007f0e1478d29b in find_S_FBConfigs () at /usr/lib64/libj3dcore-ogl.so
> 10 0x00007f0e1478d3dc in find_S_S_FBConfigs () at /usr/lib64/libj3dcore-ogl.so
> 11 0x00007f0e1478d567 in find_AA_S_S_FBConfigs () at 
> /usr/lib64/libj3dcore-ogl.so
> 12 0x00007f0e1478d728 in find_DB_AA_S_S_FBConfigs () at 
> /usr/lib64/libj3dcore-ogl.so
> 13 0x00007f0e1478d97c in 
> Java_javax_media_j3d_X11NativeConfigTemplate3D_chooseOglVisual () at 
> /usr/lib64/libj3dcore-ogl.so
> 
> While ScreenCount(dpy) is actually 1:
> (gdb) p dpy->nscreens
> $2 = 1
> screen=1 is passed to glXGetFBConfigs.
> 
> Fix this typo in glXGetFBConfigs.
> 
> Signed-off-by: Jiri Slaby <jsl...@suse.cz>
> Cc: <mesa-sta...@lists.freedesktop.org>

Reviewed-by: Adam Jackson <a...@redhat.com>

- ajax
_______________________________________________
mesa-dev mailing list
mesa-dev@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/mesa-dev

Reply via email to