diff options
| author | Daniel Vetter <daniel.vetter@ffwll.ch> | 2009-10-14 18:09:08 +0200 |
|---|---|---|
| committer | Eric Anholt <eric@anholt.net> | 2009-10-15 12:36:17 -0700 |
| commit | aaedeffe00d9414bb03723dbc30b4938a07ce5fa (patch) | |
| tree | 947fe1d1d0f063c85f9071140edd4fddf29a785b | |
| parent | 703e3326bb41528cc57c0d25003707df209fc714 (diff) | |
Xv overlay: fix planar YUV copy for right rotated crtcs
While copying and rotating the buffer, array access was out of bounds when
rotated to the right (RR_Rotate_270). My buffer handling changes probably
made this bug much more likely to actually result in a SIGSEGV.
I've checked the logs and the bug exists since rotation has been supported,
i.e. this looks like a candidate for cherry-picking for all supported
releases.
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Eric Anholt <eric@anholt.net>
| -rw-r--r-- | src/i830_video.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/i830_video.c b/src/i830_video.c index 191f44e2..848099d1 100644 --- a/src/i830_video.c +++ b/src/i830_video.c @@ -887,13 +887,13 @@ I830CopyPackedData(intel_adaptor_private *adaptor_priv, dst[(((h - i) * 2) - 3) + (j * dstPitch)] = src[(j * 2) + 1 + (i * srcPitch)]; dst[(((h - i) * 2) - 3) + - ((j - 1) * dstPitch)] = + ((j + 1) * dstPitch)] = src[(j * 2) + 1 + ((i + 1) * srcPitch)]; /* Copy V */ dst[(((h - i) * 2) - 1) + (j * dstPitch)] = src[(j * 2) + 3 + (i * srcPitch)]; dst[(((h - i) * 2) - 1) + - ((j - 1) * dstPitch)] = + ((j + 1) * dstPitch)] = src[(j * 2) + 3 + ((i + 1) * srcPitch)]; } } |