sna: Clamp the drawable box to prevent int16 overflow

And assert that the box is valid when migrating.

References: https://bugs.freedesktop.org/show_bug.cgi?id=56591
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

5 files changed, 27 insertions, 37 deletions

diff --git a/src/sna/sna.h b/src/sna/sna.h
index d44dfeb5..45cfebe3 100644
--- a/src/sna/sna.h
+++ b/src/sna/sna.h
@@ -481,6 +481,24 @@ struct kgem_bo *
 sna_drawable_use_bo(DrawablePtr drawable, unsigned flags, const BoxRec *box,
 		    struct sna_damage ***damage);
 
+inline static int16_t bound(int16_t a, uint16_t b)
+{
+	int v = (int)a + (int)b;
+	if (v > MAXSHORT)
+		return MAXSHORT;
+	return v;
+}
+
+inline static int16_t clamp(int16_t a, int16_t b)
+{
+	int v = (int)a + (int)b;
+	if (v > MAXSHORT)
+		return MAXSHORT;
+	if (v < MINSHORT)
+		return MINSHORT;
+	return v;
+}
+
 static inline bool
 box_inplace(PixmapPtr pixmap, const BoxRec *box)
 {
diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c
index b56eb63d..89cee2a0 100644
--- a/src/sna/sna_accel.c
+++ b/src/sna/sna_accel.c
@@ -2359,8 +2359,11 @@ sna_pixmap_move_area_to_gpu(PixmapPtr pixmap, const BoxRec *box, unsigned int fl
 	struct sna_pixmap *priv = sna_pixmap(pixmap);
 	RegionRec i, r;
 
-	DBG(("%s()\n", __FUNCTION__));
+	DBG(("%s: pixmap=%ld box=(%d, %d), (%d, %d), flags=%lx\n",
+	     __FUNCTION__, pixmap->drawable.serialNumber,
+	     box->x1, box->y1, box->x2, box->y2, flags));
 
+	assert(box->x2 > box->x1 && box->y2 > box->y1);
 	assert_pixmap_damage(pixmap);
 	assert_pixmap_contains_box(pixmap, box);
 	assert(!wedged(sna));
@@ -2573,6 +2576,7 @@ sna_drawable_use_bo(DrawablePtr drawable, unsigned flags, const BoxRec *box,
 	     box->x1, box->y1, box->x2, box->y2,
 	     flags));
 
+	assert(box->x2 > box->x1 && box->y2 > box->y1);
 	assert_pixmap_damage(pixmap);
 	assert_drawable_contains_box(drawable, box);
 
@@ -3335,24 +3339,6 @@ static inline void box_add_pt(BoxPtr box, int16_t x, int16_t y)
 		box->y2 = y;
 }
 
-static int16_t bound(int16_t a, uint16_t b)
-{
-	int v = (int)a + (int)b;
-	if (v > MAXSHORT)
-		return MAXSHORT;
-	return v;
-}
-
-static int16_t clamp(int16_t a, int16_t b)
-{
-	int v = (int)a + (int)b;
-	if (v > MAXSHORT)
-		return MAXSHORT;
-	if (v < MINSHORT)
-		return MINSHORT;
-	return v;
-}
-
 static inline bool box32_to_box16(const Box32Rec *b32, BoxRec *b16)
 {
 	b16->x1 = b32->x1;
diff --git a/src/sna/sna_composite.c b/src/sna/sna_composite.c
index c2af3b4e..329e9d91 100644
--- a/src/sna/sna_composite.c
+++ b/src/sna/sna_composite.c
@@ -619,14 +619,6 @@ out:
 	REGION_UNINIT(NULL, &region);
 }
 
-static int16_t bound(int16_t a, uint16_t b)
-{
-	int v = (int)a + (int)b;
-	if (v > MAXSHORT)
-		return MAXSHORT;
-	return v;
-}
-
 static bool
 _pixman_region_init_clipped_rectangles(pixman_region16_t *region,
 				       unsigned int num_rects,
diff --git a/src/sna/sna_render.c b/src/sna/sna_render.c
index b9e47be0..d1012242 100644
--- a/src/sna/sna_render.c
+++ b/src/sna/sna_render.c
@@ -38,14 +38,6 @@
 #define DBG_FORCE_UPLOAD 0
 #define DBG_NO_CPU_BO 0
 
-inline static int16_t bound(int16_t a, uint16_t b)
-{
-	int v = (int)a + (int)b;
-	if (v > MAXSHORT)
-		return MAXSHORT;
-	return v;
-}
-
 CARD32
 sna_format_for_depth(int depth)
 {
diff --git a/src/sna/sna_render_inline.h b/src/sna/sna_render_inline.h
index a796903f..750faf54 100644
--- a/src/sna/sna_render_inline.h
+++ b/src/sna/sna_render_inline.h
@@ -146,8 +146,8 @@ sna_render_picture_extents(PicturePtr p, BoxRec *box)
 {
 	box->x1 = p->pDrawable->x;
 	box->y1 = p->pDrawable->y;
-	box->x2 = p->pDrawable->x + p->pDrawable->width;
-	box->y2 = p->pDrawable->y + p->pDrawable->height;
+	box->x2 = bound(box->x1, p->pDrawable->width);
+	box->y2 = bound(box->y1, p->pDrawable->height);
 
 	if (box->x1 < p->pCompositeClip->extents.x1)
 		box->x1 = p->pCompositeClip->extents.x1;
@@ -158,6 +158,8 @@ sna_render_picture_extents(PicturePtr p, BoxRec *box)
 		box->x2 = p->pCompositeClip->extents.x2;
 	if (box->y2 > p->pCompositeClip->extents.y2)
 		box->y2 = p->pCompositeClip->extents.y2;
+
+	assert(box->x2 > box->x1 && box->y2 > box->y1);
 }
 
 static inline void