commit 3868385f0742f4309d6950d74d070760f3e2b77a
author Manuel Alfayate Corchete <redwindwanderer@gmail.com> Sun Sep 13 21:41:10 2020 +0200
committer Manuel Alfayate Corchete <redwindwanderer@gmail.com> Sun Sep 13 21:41:10 2020 +0200
tree 80d62e68ce75406be96baa9f905e116e9153db6d
parent bdac59b6dbe86be9ddb1650142524c4c3a5ed041

kmsdrm: merge heap buffer overflow and cursor creation patches from meyraud705.

src/video/kmsdrm/SDL_kmsdrmmouse.c

diff --git a/src/video/kmsdrm/SDL_kmsdrmmouse.c b/src/video/kmsdrm/SDL_kmsdrmmouse.c
index 0ead2e6..15ddf70 100644
--- a/src/video/kmsdrm/SDL_kmsdrmmouse.c
+++ b/src/video/kmsdrm/SDL_kmsdrmmouse.c
@@ -140,7 +140,7 @@
             goto cleanup;
     }
 
-    if (usable_cursor_w == 0 || usable_cursor_w == 0) {
+    if (usable_cursor_w == 0 || usable_cursor_h == 0) {
             SDL_SetError("Could not get an usable GBM cursor size");
             goto cleanup;
     }

src/video/kmsdrm/SDL_kmsdrmvideo.c

diff --git a/src/video/kmsdrm/SDL_kmsdrmvideo.c b/src/video/kmsdrm/SDL_kmsdrmvideo.c
index a3efa51..2ce3cd4 100644
--- a/src/video/kmsdrm/SDL_kmsdrmvideo.c
+++ b/src/video/kmsdrm/SDL_kmsdrmvideo.c
@@ -536,7 +536,7 @@
     uint32_t plane_id;
     SDL_VideoData *viddata = ((SDL_VideoData *)_this->driverdata);
 
-    *plane = SDL_calloc(1, sizeof(*plane));
+    *plane = SDL_calloc(1, sizeof(**plane));
 
     /* Get plane ID. */
     plane_id = get_plane_id(_this, plane_type);
@@ -554,7 +554,7 @@
 	    (*plane)->plane->plane_id, DRM_MODE_OBJECT_PLANE);	
 
         (*plane)->props_info = SDL_calloc((*plane)->props->count_props,
-            sizeof((*plane)->props_info));	
+            sizeof(*(*plane)->props_info));
 
         for (unsigned int i = 0; i < (*plane)->props->count_props; i++) {
             (*plane)->props_info[i] = KMSDRM_drmModeGetProperty(viddata->drm_fd,
@@ -1291,7 +1291,7 @@
         dispdata->crtc->crtc->crtc_id, DRM_MODE_OBJECT_CRTC);	
 
     dispdata->crtc->props_info = SDL_calloc(dispdata->crtc->props->count_props,
-        sizeof(dispdata->crtc->props_info));	
+        sizeof(*dispdata->crtc->props_info));
 
     for (unsigned int i = 0; i < dispdata->crtc->props->count_props; i++) {
 	dispdata->crtc->props_info[i] = KMSDRM_drmModeGetProperty(viddata->drm_fd,
@@ -1303,7 +1303,7 @@
         dispdata->connector->connector->connector_id, DRM_MODE_OBJECT_CONNECTOR);	
 
     dispdata->connector->props_info = SDL_calloc(dispdata->connector->props->count_props,
-        sizeof(dispdata->connector->props_info));	
+        sizeof(*dispdata->connector->props_info));
 
     for (unsigned int i = 0; i < dispdata->connector->props->count_props; i++) {
 	dispdata->connector->props_info[i] = KMSDRM_drmModeGetProperty(viddata->drm_fd,