From 770ff1cf7071f1e53d7e52df129bdc3ba2099b17 Mon Sep 17 00:00:00 2001 From: Jesse Hall Date: Fri, 21 Aug 2015 07:41:46 -0700 Subject: libagl: Fix buffer read overrun in eglCreatePbufferSurface The code was assuming that EGL_NONE==0, which isn't true. Bug: 23403170 Change-Id: Ic1eccdef086b4d610bd78dbb6b2ae883c91dc322 --- opengl/libagl/egl.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/opengl/libagl/egl.cpp b/opengl/libagl/egl.cpp index 593d0c2..ee790c9 100644 --- a/opengl/libagl/egl.cpp +++ b/opengl/libagl/egl.cpp @@ -1373,7 +1373,7 @@ static EGLSurface createPbufferSurface(EGLDisplay dpy, EGLConfig config, int32_t w = 0; int32_t h = 0; - while (attrib_list[0]) { + while (attrib_list[0] != EGL_NONE) { if (attrib_list[0] == EGL_WIDTH) w = attrib_list[1]; if (attrib_list[0] == EGL_HEIGHT) h = attrib_list[1]; attrib_list+=2; -- cgit v1.1