> 165 + memset(dest, 0, buffer_stride * (gbm_bo_get_height(buffer) -
> image_height));
>
> "gbm_bo_get_height(buffer) - image_height" could be negative and implicitly
> converted to size_t (so a huge number - Needs a check.
Unless I'm missing something (always possible) there is a check Vis:
if (image_width > min_buffer_width || image_height > min_buffer_height)
{ BOOST_THROW_EXCEPTION(std::logic_error("Image is too big for GBM cursor buffer"));
}
AIUI min_buffer_height ought to be <= gbm_bo_get_height(buffer)
> +{ gbm_bo* &>(from. buffer) = nullptr; gbm_device* &>(from. device) = nullptr;
> 87 + const_cast<
> 88 + const_cast<
>
> Seems like undefined behavior.
Fixed
> 165 + memset(dest, 0, buffer_stride * (gbm_bo_ get_height( buffer) - get_height( buffer) - image_height" could be negative and implicitly
> image_height));
>
> "gbm_bo_
> converted to size_t (so a huge number - Needs a check.
Unless I'm missing something (always possible) there is a check Vis:
if (image_width > min_buffer_width || image_height > min_buffer_height)
BOOST_ THROW_EXCEPTION (std::logic_ error(" Image is too big for GBM cursor buffer"));
{
}
AIUI min_buffer_height ought to be <= gbm_bo_ get_height( buffer)