From eb7e9068865e312a0efb5c863d0d3be6e7571d8d Mon Sep 17 00:00:00 2001
From: David Redondo <kde@david-redondo.de>
Date: Fri, 14 Apr 2023 11:47:43 +0200
Subject: [PATCH] egl/wayland: fix oob buffer access during buffer_fds clean up

After iterating through the number of planes in the above for
loop i is more than the number of planes which corresponds to
the size of the buffer_fds array.

Fixes: 967b9ad084e ("egl/wayland: for prime, allocate linear_copy from display GPU VRAM")
Signed-off-by: David Redondo <kde@david-redondo.de>
Reviewed-by: Simon Ser <contact@emersion.fr>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/22496>
---
 src/egl/drivers/dri2/platform_wayland.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/egl/drivers/dri2/platform_wayland.c b/src/egl/drivers/dri2/platform_wayland.c
index fe152294a85..4a896269d0c 100644
--- a/src/egl/drivers/dri2/platform_wayland.c
+++ b/src/egl/drivers/dri2/platform_wayland.c
@@ -1121,10 +1121,10 @@ get_back_bo(struct dri2_egl_surface *dri2_surf)
                                                    &strides[0],
                                                    &offsets[0],
                                                    dri2_surf->back);
-            do {
+            for (i = 0; i < num_planes; ++i) {
                if (buffer_fds[i] != -1)
                   close(buffer_fds[i]);
-            } while (--i >= 0);
+            }
             dri2_dpy->image->destroyImage(linear_copy_display_gpu_image);
          }
       }