fb = fb_from_base(pipe->base.fbs[i]);
if (counter != 0 && counter == pipe->counter && fb->flipid == counter) {
pipe->base.front = &fb->base;
+ fb->flipid = 0;
flipped = true;
- }
-
- if (counter - fb->flipid < UINT16_MAX) {
+ } else if (counter - fb->flipid < UINT16_MAX) {
fb->flipid = 0;
back = fb;
} else if (fb->flipid == 0) {
}
}
- if (!pipe->base.back)
+ if (!pipe->base.back && back)
pipe->base.back = &back->base;
if (flipped) {
for (i = 0; i < l; i += event->length) {
event = (void*)&buf[i];
- if (i + event->length > l) {
+ if (i + (ssize_t)sizeof(*event) > l || i + (ssize_t)event->length > l) {
log_debug("grdrm: %s/%s: truncated event", card->base.session->name, card->base.name);
break;
}