diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2013-07-12 23:22:59 +0100 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2013-07-12 23:29:10 +0100 |
| commit | 2b16eaefb38b4a6efe50a397e68793ab9a1cb2ef (patch) | |
| tree | 53c496dfbbcb70549d17b2d72ebb8b37e92cb18c /src/sna/sna_tiling.c | |
| parent | 835ceccb27afa18704c34dc3283476340f999317 (diff) | |
sna: Avoid integer overflow when computing the tiled extents
When stepping over the tiles, beware that the step may overflow the
int16_t region extents, so use an int for the calculation.
Reported-by: Andrew Woodward
Bugzilla: https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/1200766
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Diffstat (limited to 'src/sna/sna_tiling.c')
| -rw-r--r-- | src/sna/sna_tiling.c | 45 |
1 files changed, 24 insertions, 21 deletions
diff --git a/src/sna/sna_tiling.c b/src/sna/sna_tiling.c index e6cc1939..aa5fe8ff 100644 --- a/src/sna/sna_tiling.c +++ b/src/sna/sna_tiling.c @@ -607,18 +607,19 @@ sna_tiling_fill_boxes(struct sna *sna, for (tile.extents.y1 = tile.extents.y2 = region.extents.y1; tile.extents.y2 < region.extents.y2; tile.extents.y1 = tile.extents.y2) { - tile.extents.y2 = tile.extents.y1 + step; - if (tile.extents.y2 > region.extents.y2) - tile.extents.y2 = region.extents.y2; + int y2 = tile.extents.y1 + step; + if (y2 > region.extents.y2) + y2 = region.extents.y2; + tile.extents.y2 = y2; for (tile.extents.x1 = tile.extents.x2 = region.extents.x1; tile.extents.x2 < region.extents.x2; tile.extents.x1 = tile.extents.x2) { PixmapRec tmp; - - tile.extents.x2 = tile.extents.x1 + step; - if (tile.extents.x2 > region.extents.x2) - tile.extents.x2 = region.extents.x2; + int x2 = tile.extents.x1 + step; + if (x2 > region.extents.x2) + x2 = region.extents.x2; + tile.extents.x2 = x2; tile.data = NULL; @@ -733,18 +734,19 @@ bool sna_tiling_blt_copy_boxes(struct sna *sna, uint8_t alu, for (tile.extents.y1 = tile.extents.y2 = region.extents.y1; tile.extents.y2 < region.extents.y2; tile.extents.y1 = tile.extents.y2) { - tile.extents.y2 = tile.extents.y1 + step; - if (tile.extents.y2 > region.extents.y2) - tile.extents.y2 = region.extents.y2; + int y2 = tile.extents.y1 + step; + if (y2 > region.extents.y2) + y2 = region.extents.y2; + tile.extents.y2 = y2; for (tile.extents.x1 = tile.extents.x2 = region.extents.x1; tile.extents.x2 < region.extents.x2; tile.extents.x1 = tile.extents.x2) { int w, h; - - tile.extents.x2 = tile.extents.x1 + step; - if (tile.extents.x2 > region.extents.x2) - tile.extents.x2 = region.extents.x2; + int x2 = tile.extents.x1 + step; + if (x2 > region.extents.x2) + x2 = region.extents.x2; + tile.extents.x2 = x2; tile.data = NULL; @@ -851,16 +853,17 @@ sna_tiling_copy_boxes(struct sna *sna, uint8_t alu, p.devPrivate.ptr = NULL; for (tile.y1 = extents.y1; tile.y1 < extents.y2; tile.y1 = tile.y2) { - tile.y2 = tile.y1 + step; - if (tile.y2 > extents.y2) - tile.y2 = extents.y2; + int y2 = tile.y1 + step; + if (y2 > extents.y2) + y2 = extents.y2; + tile.y2 = y2; for (tile.x1 = extents.x1; tile.x1 < extents.x2; tile.x1 = tile.x2) { struct kgem_bo *tmp_bo; - - tile.x2 = tile.x1 + step; - if (tile.x2 > extents.x2) - tile.x2 = extents.x2; + int x2 = tile.x1 + step; + if (x2 > extents.x2) + x2 = extents.x2; + tile.x2 = x2; c = clipped; for (i = 0; i < n; i++) { |