From ecf8e4a64ca48eda14314b84ccd061713492d122 Mon Sep 17 00:00:00 2001 From: Vadym Shovkoplias Date: Mon, 27 Nov 2017 12:15:13 +0200 Subject: intel/blorp: Fix possible NULL pointer dereferencing Fix incomplete check of input params in blorp_surf_convert_to_uncompressed() which can lead to NULL pointer dereferencing. Fixes: 5ae8043fed2 ("intel/blorp: Add an entrypoint for doing bit-for-bit copies") Fixes: f395d0abc83 ("intel/blorp: Internally expose surf_convert_to_uncompressed") Reviewed-by: Emil Velikov Reviewed-by: Andres Gomez (cherry picked from commit cdb3eb7174f84f3200408c4b43c819fb093da9c6) [Emil Velikov: drop non-applicable x/y hunk] Signed-off-by: Emil Velikov Conflicts: src/intel/blorp/blorp_blit.c --- src/intel/blorp/blorp_blit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/intel/blorp/blorp_blit.c b/src/intel/blorp/blorp_blit.c index 35008cbbb0a..8bc5f2d2c2f 100644 --- a/src/intel/blorp/blorp_blit.c +++ b/src/intel/blorp/blorp_blit.c @@ -2343,7 +2343,7 @@ surf_convert_to_uncompressed(const struct isl_device *isl_dev, */ blorp_surf_convert_to_single_slice(isl_dev, info); - if (width || height) { + if (width && height) { #ifndef NDEBUG uint32_t right_edge_px = info->tile_x_sa + *x + *width; uint32_t bottom_edge_px = info->tile_y_sa + *y + *height; -- cgit v1.2.3