diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2012-09-23 09:41:59 +0100 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2012-09-23 09:41:59 +0100 |
| commit | 0afb7efe8c48b5fc839e2137e870bea0f5fb3c9c (patch) | |
| tree | c9d2c02785cab591215cb38201932c852b94d5bb | |
| parent | 0fc6e5820e4543d52bcf8d0285ca6f69b5213831 (diff) | |
sna: Avoid overflows when translating the box16 extents during a copy
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
| -rw-r--r-- | src/sna/sna_accel.c | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c index 58029c89..a2afce06 100644 --- a/src/sna/sna_accel.c +++ b/src/sna/sna_accel.c @@ -3332,6 +3332,16 @@ static int16_t bound(int16_t a, uint16_t b) return v; } +static int16_t clamp(int16_t a, int16_t b) +{ + int v = (int)a + (int)b; + if (v > MAXSHORT) + return MAXSHORT; + if (v < MINSHORT) + return MINSHORT; + return v; +} + static inline bool box32_to_box16(const Box32Rec *b32, BoxRec *b16) { b16->x1 = b32->x1; @@ -4880,10 +4890,10 @@ sna_do_copy(DrawablePtr src, DrawablePtr dst, GCPtr gc, return NULL; } - region.extents.x1 += sx - dx; - region.extents.x2 += sx - dx; - region.extents.y1 += sy - dy; - region.extents.y2 += sy - dy; + region.extents.x1 = clamp(region.extents.x1, sx - dx); + region.extents.x2 = clamp(region.extents.x2, sx - dx); + region.extents.y1 = clamp(region.extents.y1, sy - dy); + region.extents.y2 = clamp(region.extents.y2, sy - dy); /* Compute source clip region */ clip = NULL; |