sna: Avoid accessing past the end of the clip boxes for incremental clipping

During incremental clipping of the trapezoids, we can assign the end
BoxPtr to begin, and so we should be careful not to dereference that
pointer (as it points passed the end of the clip boxes).

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

1 files changed, 12 insertions, 6 deletions

diff --git a/src/sna/sna.h b/src/sna/sna.h
index 4fdb541c..bd5c38bf 100644
--- a/src/sna/sna.h
+++ b/src/sna/sna.h
@@ -1194,12 +1194,18 @@ __find_clip_box_for_y(const BoxRec *begin, const BoxRec *end, int16_t y);
 inline static const BoxRec *
 find_clip_box_for_y(const BoxRec *begin, const BoxRec *end, int16_t y)
 {
-    if (begin->y2 > y)
-	    return begin;
-    if (y > end[-1].y2)
-	    return end;
-
-    return __find_clip_box_for_y(begin, end, y);
+	/* Special case for incremental trapezoid clipping */
+	if (begin == end)
+		return end;
+
+	/* Quick test if scanline is within range of clip boxes */
+	if (begin->y2 > y)
+		return begin;
+	if (y > end[-1].y2)
+		return end;
+
+	/* Otherwise bisect to find the first box crossing y */
+	return __find_clip_box_for_y(begin, end, y);
 }
 
 unsigned sna_cpu_detect(void);