Improve FBC size checking

In hindsight, this is obvious, since nowhere do we tell the FBC unit how much
memory it has available.  We need to make sure the compressed buffer is big
enough to handle the uncompresed buffer, both in terms of vertical size and
total framebuffer size, or the compressor could overwrite the memory
immediately following the compressed buffer.
(cherry picked from commit 7332132a79e5b5c208d43e93dfe0c8b12eb1728d)

1 files changed, 14 insertions, 0 deletions

diff --git a/src/i830_display.c b/src/i830_display.c
index df3a6bea..306fed49 100644
--- a/src/i830_display.c
+++ b/src/i830_display.c
@@ -693,6 +693,7 @@ i830_use_fb_compression(xf86CrtcPtr crtc)
     xf86CrtcConfigPtr xf86_config = XF86_CRTC_CONFIG_PTR(pScrn);
     I830Ptr pI830 = I830PTR(pScrn);
     I830CrtcPrivatePtr	intel_crtc = crtc->driver_private;
+    unsigned long uncompressed_size;
     int plane = (intel_crtc->plane == 0 ? FBC_CTL_PLANEA : FBC_CTL_PLANEB);
     int i, count = 0;
 
@@ -724,6 +725,19 @@ i830_use_fb_compression(xf86CrtcPtr crtc)
 	  pScrn->bitsPerPixel == 32)) /* mode_set dtrt if fbc is in use */
 	return FALSE;
 
+    /* Can't cache more lines than we can track */
+    if (crtc->mode.VDisplay > FBC_LL_SIZE)
+	return FALSE;
+
+    /*
+     * Make sure the compressor doesn't go past the end of our compressed
+     * buffer if the uncompressed size is large.
+     */
+    uncompressed_size = crtc->mode.HDisplay * crtc->mode.VDisplay *
+	pI830->cpp;
+    if (pI830->compressed_front_buffer->size < uncompressed_size)
+	return FALSE;
+
     /*
      * No checks for pixel multiply, incl. horizontal, or interlaced modes
      * since they're currently unused.