X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Flibsystemd-terminal%2Fgrdev-drm.c;h=7a6e1d993b9368f1088a2a0cd57f992cf94ebf6c;hb=db1a606610e5a528903a4380f30c9934a0c5a134;hp=5c65c096dec2cdfb736f0963698a06057ec01d3c;hpb=ce540a24d53e1751a5b69224d5a7f5a59f2de7ad;p=elogind.git

diff --git a/src/libsystemd-terminal/grdev-drm.c b/src/libsystemd-terminal/grdev-drm.c
index 5c65c096d..7a6e1d993 100644
--- a/src/libsystemd-terminal/grdev-drm.c
+++ b/src/libsystemd-terminal/grdev-drm.c
@@ -1362,10 +1362,9 @@ static void grdrm_crtc_flip_complete(grdrm_crtc *crtc, uint32_t counter, struct
                 fb = fb_from_base(pipe->base.fbs[i]);
                 if (counter != 0 && counter == pipe->counter && fb->flipid == counter) {
                         pipe->base.front = &fb->base;
+                        fb->flipid = 0;
                         flipped = true;
-                }
-
-                if (counter - fb->flipid < UINT16_MAX) {
+                } else if (counter - fb->flipid < UINT16_MAX) {
                         fb->flipid = 0;
                         back = fb;
                 } else if (fb->flipid == 0) {
@@ -1373,7 +1372,7 @@ static void grdrm_crtc_flip_complete(grdrm_crtc *crtc, uint32_t counter, struct
                 }
         }
 
-        if (!pipe->base.back)
+        if (!pipe->base.back && back)
                 pipe->base.back = &back->base;
 
         if (flipped) {
@@ -2223,7 +2222,7 @@ static int grdrm_card_io_fn(sd_event_source *s, int fd, uint32_t revents, void *
                 for (i = 0; i < l; i += event->length) {
                         event = (void*)&buf[i];
 
-                        if (i + event->length > l) {
+                        if (i + (ssize_t)sizeof(*event) > l || i + (ssize_t)event->length > l) {
                                 log_debug("grdrm: %s/%s: truncated event", card->base.session->name, card->base.name);
                                 break;
                         }