glsl: fix heap-buffer-overflow
The `end+1` skips the ']', whereas the `strlen+1` includes the final '\0' in the move to terminate the string. Cc: mesa-stable@lists.freedesktop.org Reviewed-by: Eric Engestrom <eric.engestrom@imgtec.com> Reviewed-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
This commit is contained in:
parent
658568941d
commit
fc27181f9e
|
@ -535,7 +535,7 @@ private:
|
|||
const char *str_end;
|
||||
while((str_start = strchr(name_copy, '[')) &&
|
||||
(str_end = strchr(name_copy, ']'))) {
|
||||
memmove(str_start, str_end + 1, 1 + strlen(str_end));
|
||||
memmove(str_start, str_end + 1, 1 + strlen(str_end + 1));
|
||||
}
|
||||
|
||||
unsigned index = 0;
|
||||
|
|
Loading…
Reference in New Issue