Commit 70e56410 authored by Dominik Behr's avatar Dominik Behr Committed by Keith Packard

xf86RandR12: use correct gamma size when allocating gamma table

When setting crtc->gamma_size to randr_crtc->gammaSize we should
use randr_crtc->gammaSize to allocate new gamma table in crtc.
Currently, if randr_crtc->gammaSize > crtc->gammaSize the subsequent
memcpy will overwrite memory beyond the end of gamma table.
Signed-off-by: Dominik Behr's avatarDominik Behr <>
Reviewed-by: default avatarStéphane Marchesin <>
Signed-off-by: Keith Packard's avatarKeith Packard <>
parent 35d275c7
......@@ -1256,12 +1256,13 @@ xf86RandR12CrtcSetGamma(ScreenPtr pScreen, RRCrtcPtr randr_crtc)
CARD16 *tmp_ptr;
tmp_ptr =
realloc(crtc->gamma_red, 3 * crtc->gamma_size * sizeof(CARD16));
3 * randr_crtc->gammaSize * sizeof(CARD16));
if (!tmp_ptr)
return FALSE;
crtc->gamma_red = tmp_ptr;
crtc->gamma_green = crtc->gamma_red + crtc->gamma_size;
crtc->gamma_blue = crtc->gamma_green + crtc->gamma_size;
crtc->gamma_green = crtc->gamma_red + randr_crtc->gammaSize;
crtc->gamma_blue = crtc->gamma_green + randr_crtc->gammaSize;
crtc->gamma_size = randr_crtc->gammaSize;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment