diff options
| -rw-r--r-- | src/sna/blt.c | 5 | ||||
| -rw-r--r-- | src/sna/sna_blt.c | 18 |
2 files changed, 14 insertions, 9 deletions
diff --git a/src/sna/blt.c b/src/sna/blt.c index 1ad5eeeb..853eb20d 100644 --- a/src/sna/blt.c +++ b/src/sna/blt.c @@ -153,6 +153,8 @@ memcpy_blt(const void *src, void *dst, int bpp, assert(dst); assert(width && height); assert(bpp >= 8); + assert(width*bpp <= 8*src_stride); + assert(width*bpp <= 8*dst_stride); DBG(("%s: src=(%d, %d), dst=(%d, %d), size=%dx%d, pitch=%d/%d\n", __FUNCTION__, src_x, src_y, dst_x, dst_y, width, height, src_stride, dst_stride)); @@ -245,6 +247,7 @@ memmove_box(const void *src, void *dst, width = (box->x2 - box->x1) * bpp; height = (box->y2 - box->y1); + assert(width <= 8*stride); if (width == stride) { width *= height; height = 1; @@ -372,6 +375,8 @@ memcpy_xor(const void *src, void *dst, int bpp, assert(width && height); assert(bpp >= 8); + assert(width*bpp <= 8*src_stride); + assert(width*bpp <= 8*dst_stride); DBG(("%s: src=(%d, %d), dst=(%d, %d), size=%dx%d, pitch=%d/%d, bpp=%d, and=%x, xor=%x\n", __FUNCTION__, diff --git a/src/sna/sna_blt.c b/src/sna/sna_blt.c index 750d749b..656e979f 100644 --- a/src/sna/sna_blt.c +++ b/src/sna/sna_blt.c @@ -1278,8 +1278,8 @@ blt_put_composite__cpu(struct sna *sna, memcpy_blt(src->devPrivate.ptr, dst->devPrivate.ptr, src->drawable.bitsPerPixel, src->devKind, dst->devKind, r->src.x + op->u.blt.sx, r->src.y + op->u.blt.sy, - r->width, r->height, - r->dst.x + op->dst.x, r->dst.y + op->dst.y); + r->dst.x + op->dst.x, r->dst.y + op->dst.y, + r->width, r->height); } fastcall static void @@ -1292,8 +1292,8 @@ blt_put_composite_box__cpu(struct sna *sna, memcpy_blt(src->devPrivate.ptr, dst->devPrivate.ptr, src->drawable.bitsPerPixel, src->devKind, dst->devKind, box->x1 + op->u.blt.sx, box->y1 + op->u.blt.sy, - box->x2-box->x1, box->y2-box->y1, - box->x1 + op->dst.x, box->y1 + op->dst.y); + box->x1 + op->dst.x, box->y1 + op->dst.y, + box->x2-box->x1, box->y2-box->y1); } static void @@ -1307,8 +1307,8 @@ blt_put_composite_boxes__cpu(struct sna *sna, memcpy_blt(src->devPrivate.ptr, dst->devPrivate.ptr, src->drawable.bitsPerPixel, src->devKind, dst->devKind, box->x1 + op->u.blt.sx, box->y1 + op->u.blt.sy, - box->x2-box->x1, box->y2-box->y1, - box->x1 + op->dst.x, box->y1 + op->dst.y); + box->x1 + op->dst.x, box->y1 + op->dst.y, + box->x2-box->x1, box->y2-box->y1); box++; } while (--n); } @@ -1323,8 +1323,8 @@ blt_put_composite_with_alpha__cpu(struct sna *sna, memcpy_xor(src->devPrivate.ptr, dst->devPrivate.ptr, src->drawable.bitsPerPixel, src->devKind, dst->devKind, r->src.x + op->u.blt.sx, r->src.y + op->u.blt.sy, - r->width, r->height, r->dst.x + op->dst.x, r->dst.y + op->dst.y, + r->width, r->height, 0xffffffff, op->u.blt.pixel); } @@ -1339,8 +1339,8 @@ blt_put_composite_box_with_alpha__cpu(struct sna *sna, memcpy_xor(src->devPrivate.ptr, dst->devPrivate.ptr, src->drawable.bitsPerPixel, src->devKind, dst->devKind, box->x1 + op->u.blt.sx, box->y1 + op->u.blt.sy, - box->x2-box->x1, box->y2-box->y1, box->x1 + op->dst.x, box->y1 + op->dst.y, + box->x2-box->x1, box->y2-box->y1, 0xffffffff, op->u.blt.pixel); } @@ -1355,8 +1355,8 @@ blt_put_composite_boxes_with_alpha__cpu(struct sna *sna, memcpy_xor(src->devPrivate.ptr, dst->devPrivate.ptr, src->drawable.bitsPerPixel, src->devKind, dst->devKind, box->x1 + op->u.blt.sx, box->y1 + op->u.blt.sy, - box->x2-box->x1, box->y2-box->y1, box->x1 + op->dst.x, box->y1 + op->dst.y, + box->x2-box->x1, box->y2-box->y1, 0xffffffff, op->u.blt.pixel); box++; } while (--n); |