EmuGL: Fix heap corruption
Off-by-two bug when removing textures from the tracking array could overwrite malloc's mem chunk data structure, usually resulting in a heap corruption abort on a later malloc/realloc/free. Bug: 5951738 Change-Id: I11056bb62883373c2a3403f53899347ff8cdabf2
This commit is contained in:
@@ -394,7 +394,7 @@ void GLClientState::deleteTextures(GLsizei n, const GLuint* textures)
|
||||
if (texrec) {
|
||||
const TextureRec* end = m_tex.textures + m_tex.numTextures;
|
||||
memmove(texrec, texrec + 1,
|
||||
(end - texrec + 1) * sizeof(TextureRec));
|
||||
(end - texrec - 1) * sizeof(TextureRec));
|
||||
m_tex.numTextures--;
|
||||
|
||||
for (TextureUnit* unit = m_tex.unit;
|
||||
|
||||
Reference in New Issue
Block a user