From 1e1ed93ea71d60d9b6ece7ec58836db1e8a5dab8 Mon Sep 17 00:00:00 2001
From: Frediano Ziglio <fziglio@redhat.com>
Date: Wed, 4 Jan 2017 12:30:47 +0000
Subject: [PATCH] Avoid integer overflow for Drawable::refs field

This fixes a regression caused by
a43c21b6bcdda701763afb6d73e38a3c419e54c7
("DCC: change how fill_bits() marshalls data by reference").
Before the mentioned patch there were a few references to Drawable
structure so an uint8_t was enough.
Now that every chunk of the image is accounted you can easily
get an overflow.
This fixes https://bugs.freedesktop.org/show_bug.cgi?id=99258.

Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Acked-by: Pavel Grunt <pgrunt@redhat.com>
---
 server/display-channel.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/display-channel.h b/server/display-channel.h
index 715ad1a5..5ecc5c32 100644
--- a/server/display-channel.h
+++ b/server/display-channel.h
@@ -81,7 +81,7 @@ typedef struct DependItem {
 } DependItem;
 
 struct Drawable {
-    uint8_t refs;
+    uint32_t refs;
     RingItem surface_list_link;
     RingItem list_link;
     DrawItem tree_item;