diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2011-09-14 13:06:26 +0100 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2011-09-14 17:44:38 +0100 |
| commit | 4d4aca21fd32a367d78dfaf1c23b4faeabe36428 (patch) | |
| tree | 5f0ee4c2f74682f9c476a23d3261244a76fee8a0 | |
| parent | 83961051789e418f6022096b1ed2302cb2f05e5b (diff) | |
sna: assert that the memcpy upload path points to valid regions
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
| -rw-r--r-- | src/sna/blt.c | 2 | ||||
| -rw-r--r-- | src/sna/sna_accel.c | 10 |
2 files changed, 12 insertions, 0 deletions
diff --git a/src/sna/blt.c b/src/sna/blt.c index ac20372e..1d5cace0 100644 --- a/src/sna/blt.c +++ b/src/sna/blt.c @@ -50,6 +50,8 @@ memcpy_blt(const void *src, void *dst, int bpp, assert(width && height); assert(bpp >= 8); + assert((src_x + width) * bpp <= 8 * src_stride); + assert((dst_x + width) * bpp <= 8 * dst_stride); DBG(("%s: src=(%d, %d), dst=(%d, %d), size=%dx%d, pitch=%d/%d\n", __FUNCTION__, src_x, src_y, dst_x, dst_y, width, height, src_stride, dst_stride)); diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c index a6353723..aa12ec57 100644 --- a/src/sna/sna_accel.c +++ b/src/sna/sna_accel.c @@ -1053,6 +1053,16 @@ sna_put_image_blt(DrawablePtr drawable, GCPtr gc, RegionPtr region, box = REGION_RECTS(region); n = REGION_NUM_RECTS(region); do { + assert(box->x1 >= 0); + assert(box->y1 >= 0); + assert(box->x2 <= pixmap->drawable.width); + assert(box->y2 <= pixmap->drawable.height); + + assert(box->x1 - x >= 0); + assert(box->y1 - y >= 0); + assert(box->x2 - x <= w); + assert(box->y2 - y <= h); + memcpy_blt(bits, dst_bits, pixmap->drawable.bitsPerPixel, stride, dst_stride, |