From 2424b1ecddd78e6a18ebfb31ac3bbac52e4dcc0c Mon Sep 17 00:00:00 2001 From: Simon Ser Date: Thu, 28 Nov 2024 20:00:36 +0100 Subject: [PATCH] render/drm_format_set: fix corruption in wlr_drm_format_set_remove() A single byte was moved instead of a full uint64_t. This results in corrupted lists containing bogus modifiers. --- render/drm_format_set.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/render/drm_format_set.c b/render/drm_format_set.c index 9749a0093..58d65290a 100644 --- a/render/drm_format_set.c +++ b/render/drm_format_set.c @@ -95,7 +95,7 @@ bool wlr_drm_format_set_remove(struct wlr_drm_format_set *set, uint32_t format, for (size_t idx = 0; idx < fmt->len; idx++) { if (fmt->modifiers[idx] == modifier) { - memmove(&fmt->modifiers[idx], &fmt->modifiers[idx+1], fmt->len - idx - 1); + memmove(&fmt->modifiers[idx], &fmt->modifiers[idx+1], (fmt->len - idx - 1) * sizeof(fmt->modifiers[0])); fmt->len--; return true; }