Eric Anholt <[email protected]> writes: >> + for (i = narcs, arc = parcs; --i >= 0; arc++) >> + nspans += arc->height; >> + >> + pts = points = malloc (sizeof (DDXPointRec) * nspans + sizeof(int) * >> nspans); >> + if (!points) >> + return; >> + wids = widths = (int *) (points + nspans); > > Can you give me some justification of what prevents integer overflow > here?
Argh. BigRequests strikes again. I was thinking that the max request size would limit the number of arcs and keep this in check. Instead, a 16MB request would contain 1398101 arcs. If each were the maximum possible size (65536), then we'd try to allocation 91B spans. Will fix. -- [email protected]
pgpuiB733w7_e.pgp
Description: PGP signature
_______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel
