diff options
| author | Alex Deucher <alexdeucher@gmail.com> | 2009-02-09 19:50:37 -0500 |
|---|---|---|
| committer | Alex Deucher <alexdeucher@gmail.com> | 2009-02-09 19:50:37 -0500 |
| commit | 1b4afc1c9f8458f9ab3434418f4ccf959f532ac1 (patch) | |
| tree | 6ddce2233e672e35aed1716239e3cb84f27c914e /src/r600_textured_videofuncs.c | |
| parent | e85b7a1c5948b5123eddf9dfbb9e002d74fbe9fb (diff) | |
R6xx/R7xx: Add checks to make sure we don't overrun VB space
Diffstat (limited to 'src/r600_textured_videofuncs.c')
| -rw-r--r-- | src/r600_textured_videofuncs.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/r600_textured_videofuncs.c b/src/r600_textured_videofuncs.c index 24bba07d..82de88ae 100644 --- a/src/r600_textured_videofuncs.c +++ b/src/r600_textured_videofuncs.c @@ -406,6 +406,11 @@ R600DisplayTexturedVideo(ScrnInfoPtr pScrn, RADEONPortPrivPtr pPriv) struct r6xx_copy_vertex *xv_vb = (pointer)((char*)accel_state->ib->address + (accel_state->ib->total / 2)); struct r6xx_copy_vertex vertex[3]; + if (((accel_state->vb_index + 3) * 16) > (accel_state->ib->total / 2)) { + ErrorF("Ran out of VB space!\n"); + break; + } + dstX = pBox->x1 + dstxoff; dstY = pBox->y1 + dstyoff; dstw = pBox->x2 - pBox->x1; |