commit ca222b7c1868491ede19f2da717b39c0a54e6846
author Bartosz Tomczyk <bartosz.tomczyk86@gmail.com> Tue Jan 31 12:02:20 2017 +0100
committer Emil Velikov <emil.l.velikov@gmail.com> Fri Feb 03 11:08:59 2017 +0000
tree 684d075ca65beda8bcc252b0bb016185698b0840
parent 6c89a728d9e5d072cb504453e73077564c6523d3

glsl: fix heap-buffer-overflow

The `end+1` skips the ']', whereas the `strlen+1` includes the final
'\0' in the move to terminate the string.

Cc: mesa-stable@lists.freedesktop.org
Reviewed-by: Eric Engestrom <eric.engestrom@imgtec.com>
Reviewed-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
(cherry picked from commit fc27181f9e51441a26b7eb4f62794b5e9a994644)

src/compiler/glsl/link_uniforms.cpp

diff --git a/src/compiler/glsl/link_uniforms.cpp b/src/compiler/glsl/link_uniforms.cpp
index 86711e2..1949867 100644
--- a/src/compiler/glsl/link_uniforms.cpp
+++ b/src/compiler/glsl/link_uniforms.cpp
@@ -535,7 +535,7 @@
             const char *str_end;
             while((str_start = strchr(name_copy, '[')) &&
                   (str_end = strchr(name_copy, ']'))) {
-               memmove(str_start, str_end + 1, 1 + strlen(str_end));
+               memmove(str_start, str_end + 1, 1 + strlen(str_end + 1));
             }
 
             unsigned index = 0;