diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2013-11-04 15:10:40 +0000 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2013-11-04 15:12:37 +0000 |
| commit | 587c4866652e40e1e228b333028114766a6d3b08 (patch) | |
| tree | a2cb242571f8f2f9f2c679e51378e55490884746 /src/sna/blt.c | |
| parent | 8f6e227ba8127a2ca034271f2a660c24abbe056f (diff) | |
sna: Promote uint16_t to a full int to avoid overflow in computing w*h in memcpy_xor
Reported-by: Conley Moorhous <conleymoorhous@gmail.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=70527
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Diffstat (limited to 'src/sna/blt.c')
| -rw-r--r-- | src/sna/blt.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/src/sna/blt.c b/src/sna/blt.c index 4c27678d..4843a415 100644 --- a/src/sna/blt.c +++ b/src/sna/blt.c @@ -948,7 +948,7 @@ memcpy_xor(const void *src, void *dst, int bpp, { const uint8_t *src_bytes; uint8_t *dst_bytes; - int i; + int i, w; assert(width && height); assert(bpp >= 8); @@ -1001,8 +1001,9 @@ memcpy_xor(const void *src, void *dst, int bpp, } case 4: #if USE_SSE2 - if (width * 4 == dst_stride && dst_stride == src_stride) { - width *= height; + w = width; + if (w * 4 == dst_stride && dst_stride == src_stride) { + w *= height; height = 1; } @@ -1012,7 +1013,7 @@ memcpy_xor(const void *src, void *dst, int bpp, const uint32_t *s = (const uint32_t *)src_bytes; __m128i mask = xmm_create_mask_32(or); - i = width; + i = w; while (i && (uintptr_t)d & 15) { *d++ = *s++ | or; i--; @@ -1079,7 +1080,7 @@ memcpy_xor(const void *src, void *dst, int bpp, uint32_t *d = (uint32_t *)dst_bytes; uint32_t *s = (uint32_t *)src_bytes; - for (i = 0; i < width; i++) + for (i = 0; i < w; i++) d[i] = s[i] | or; src_bytes += src_stride; |