diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2009-12-08 13:47:07 +0000 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2009-12-08 13:48:48 +0000 |
| commit | 47416b1eea09b238a997636d35998d71e0d18161 (patch) | |
| tree | fd6ca5b96581a180bbdfce570515a589b9fa9d7a | |
| parent | c1afc831c8fe4cbececee7dfa23506a6746c2425 (diff) | |
i965: Maximum number of vertices per composite is 24, not 18
Beware the potential buffer overflow.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
| -rw-r--r-- | src/i965_render.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/src/i965_render.c b/src/i965_render.c index 62e17e4b..10ed5617 100644 --- a/src/i965_render.c +++ b/src/i965_render.c @@ -1682,7 +1682,7 @@ i965_composite(PixmapPtr dest, int srcX, int srcY, int maskX, int maskY, float src_x[3], src_y[3], src_w[3], mask_x[3], mask_y[3], mask_w[3]; int i; drm_intel_bo *vb_bo; - float vb[18]; + float vb[24]; /* 3 * (2 dst + 3 src + 3 mask) */ Bool is_affine = render_state->composite_op.is_affine; if (is_affine) { @@ -1801,7 +1801,6 @@ i965_composite(PixmapPtr dest, int srcX, int srcY, int maskX, int maskY, if (!is_affine) vb[i++] = mask_w[0]; } - assert(i <= VERTEX_BUFFER_SIZE); drm_intel_bo_subdata(vb_bo, render_state->vb_offset * 4, i * 4, vb); if (!i965_composite_check_aperture(scrn)) |