From: Ian Romanick <idr@us.ibm.com>
Date: Fri, 19 Aug 2005 18:53:26 +0000 (+0000)
Subject: Fix a realloc problem with indirect vertex arrays.  The actual head pointer
X-Git-Tag: 062012170305~22207
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=2ae5645115124ecc97bf4a0ba9f5542cf2409845;p=profile%2Fivi%2Fmesa.git

Fix a realloc problem with indirect vertex arrays.  The actual head pointer
wasn't tracked and used for the realloc, so it tended to explode.
---

diff --git a/src/glx/x11/indirect_va_private.h b/src/glx/x11/indirect_va_private.h
index 0b0227f..ab97dc6 100644
--- a/src/glx/x11/indirect_va_private.h
+++ b/src/glx/x11/indirect_va_private.h
@@ -211,12 +211,14 @@ struct array_state_vector {
      * There are some bytes of extra data before \c array_info_cache that is
      * used to hold the header for RenderLarge commands.  This is
      * \b not included in \c array_info_cache_size or
-     * \c array_info_cache_buffer_size.
+     * \c array_info_cache_buffer_size.  \c array_info_cache_base stores a
+     * pointer to the true start of the buffer (i.e., what malloc returned).
      */
     /*@{*/
     size_t array_info_cache_size;
     size_t array_info_cache_buffer_size;
     void * array_info_cache;
+    void * array_info_cache_base;
     /*@}*/
 
 
diff --git a/src/glx/x11/indirect_vertex_array.c b/src/glx/x11/indirect_vertex_array.c
index d4e6ab9..62a101e 100644
--- a/src/glx/x11/indirect_vertex_array.c
+++ b/src/glx/x11/indirect_vertex_array.c
@@ -382,13 +382,14 @@ allocate_array_info_cache( struct array_state_vector * arrays,
 {
 #define MAX_HEADER_SIZE 20
     if ( arrays->array_info_cache_buffer_size < required_size ) {
-	GLubyte * temp = realloc( arrays->array_info_cache, required_size 
-				  + MAX_HEADER_SIZE );
+	GLubyte * temp = realloc( arrays->array_info_cache_base,
+				  required_size + MAX_HEADER_SIZE );
 
 	if ( temp == NULL ) {
 	    return GL_FALSE;
 	}
 
+	arrays->array_info_cache_base = temp;
 	arrays->array_info_cache = temp + MAX_HEADER_SIZE;
 	arrays->array_info_cache_buffer_size = required_size;
     }