drmGetDevices returned count isn't capped
The docs say:
* \return on error - negative error code,
* if devices is NULL - total number of devices available on the system,
* alternatively the number of devices stored in devices[], which is
* capped by the max_devices.
However drmGetDevices
never caps the return value by max_devices
. It always returns the current count. This can cause out-of-bound array accesses in callers. This is also not consistent with how e.g. the Vulkan getters work.
This can break at least Xwayland and wlroots. See for instance: https://gitlab.freedesktop.org/xorg/xserver/-/blob/0b86c0c36241989d7e9662d007c5297fe22ae8b5/hw/xwayland/xwayland-glamor-gbm.c#L715