fb = fb_from_base(pipe->base.fbs[i]);
if (counter != 0 && counter == pipe->counter && fb->flipid == counter) {
pipe->base.front = &fb->base;
+ fb->flipid = 0;
flipped = true;
- }
-
- if (counter - fb->flipid < UINT16_MAX) {
+ } else if (counter - fb->flipid < UINT16_MAX) {
fb->flipid = 0;
back = fb;
} else if (fb->flipid == 0) {
}
}
- if (!pipe->base.back)
+ if (!pipe->base.back && back)
pipe->base.back = &back->base;
if (flipped) {
uint32_t id, counter;
grdrm_object *object;
char buf[4096];
- ssize_t l, i;
+ size_t len;
+ ssize_t l;
if (revents & (EPOLLHUP | EPOLLERR)) {
/* Immediately close device on HUP; no need to flush pending
log_debug("grdrm: %s/%s: read error: %m", card->base.session->name, card->base.name);
grdrm_card_close(card);
return 0;
- } else if ((size_t)l < sizeof(*event)) {
- log_debug("grdrm: %s/%s: short read of %zd bytes", card->base.session->name, card->base.name, l);
- return 0;
}
- for (i = 0; i < l; i += event->length) {
- event = (void*)&buf[i];
+ for (len = l; len > 0; len -= event->length) {
+ event = (void*)buf;
- if (i + event->length > l) {
+ if (len < sizeof(*event) || len < event->length) {
log_debug("grdrm: %s/%s: truncated event", card->base.session->name, card->base.name);
break;
}