[KMS/DRM] Fix for bug #5468: corruption on dynamic cursor changing caused by wrong buffer size.
diff --git a/src/video/kmsdrm/SDL_kmsdrmmouse.c b/src/video/kmsdrm/SDL_kmsdrmmouse.c
index 2937cb7..25d3db9 100644
--- a/src/video/kmsdrm/SDL_kmsdrmmouse.c
+++ b/src/video/kmsdrm/SDL_kmsdrmmouse.c
@@ -242,17 +242,15 @@ KMSDRM_ShowCursor(SDL_Cursor * cursor)
/* Prepare a buffer we can dump to our GBM BO (different
size, alpha premultiplication...) */
bo_stride = KMSDRM_gbm_bo_get_stride(dispdata->cursor_bo);
- bufsize = bo_stride * curdata->h;
+ bufsize = bo_stride * dispdata->cursor_h;
+
+ ready_buffer = (uint32_t*)SDL_calloc(1, bufsize);
- ready_buffer = (uint32_t*)SDL_malloc(bufsize);
if (!ready_buffer) {
ret = SDL_OutOfMemory();
goto cleanup;
}
- /* Clean the whole buffer we are preparing. */
- SDL_memset(ready_buffer, 0x00, bo_stride * curdata->h);
-
/* Copy from the cursor buffer to a buffer that we can dump to the GBM BO,
pre-multiplying by alpha each pixel as we go. */
for (i = 0; i < curdata->h; i++) {