diff options
| author | Vadym Shovkoplias <vadym.shovkoplias@globallogic.com> | 2017-11-27 12:15:13 +0200 |
|---|---|---|
| committer | Andres Gomez <agomez@igalia.com> | 2017-11-30 16:20:05 +0200 |
| commit | cdb3eb7174f84f3200408c4b43c819fb093da9c6 (patch) | |
| tree | 8e05684bcb7e0e2830aee859b9d2f98fa0c86b0e /src/intel/blorp | |
| parent | faccbaf3faf9a7cdcda3e4032fafd0f6064459bd (diff) | |
intel/blorp: Fix possible NULL pointer dereferencing
Fix incomplete check of input params in blorp_surf_convert_to_uncompressed()
which can lead to NULL pointer dereferencing.
Fixes: 5ae8043fed2 ("intel/blorp: Add an entrypoint for doing
bit-for-bit copies")
Fixes: f395d0abc83 ("intel/blorp: Internally expose
surf_convert_to_uncompressed")
Reviewed-by: Emil Velikov <emli.velikov@collabora.com>
Reviewed-by: Andres Gomez <agomez@igalia.com>
Diffstat (limited to 'src/intel/blorp')
| -rw-r--r-- | src/intel/blorp/blorp_blit.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/intel/blorp/blorp_blit.c b/src/intel/blorp/blorp_blit.c index d119a99b31f..0757db0d04b 100644 --- a/src/intel/blorp/blorp_blit.c +++ b/src/intel/blorp/blorp_blit.c @@ -2351,7 +2351,7 @@ blorp_surf_convert_to_uncompressed(const struct isl_device *isl_dev, */ blorp_surf_convert_to_single_slice(isl_dev, info); - if (width || height) { + if (width && height) { #ifndef NDEBUG uint32_t right_edge_px = info->tile_x_sa + *x + *width; uint32_t bottom_edge_px = info->tile_y_sa + *y + *height; @@ -2364,7 +2364,7 @@ blorp_surf_convert_to_uncompressed(const struct isl_device *isl_dev, *height = DIV_ROUND_UP(*height, fmtl->bh); } - if (x || y) { + if (x && y) { assert(*x % fmtl->bw == 0); assert(*y % fmtl->bh == 0); *x /= fmtl->bw; |