summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDaniel Drake <dsd@laptop.org>2010-08-05 08:08:06 +0300
committerMartin-√Čric Racine <q-funk@iki.fi>2010-08-05 08:08:06 +0300
commite9effca821c1d604aeffeb3d3e7a49539485117d (patch)
treeaf4736bfab1d7acf065b210e36344c55b3d082b5
parentf0df6821c454d2b174a071fd846b399e8c2f98f5 (diff)
http://lists.x.org/archives/xorg-driver-geode/2010-August/000938.html
https://bugs.freedesktop.org/show_bug.cgi?id=29391 LXCopyFromSys currently is hardcoded to operate on 16bpp data. And indeed, when working with packed data (e.g. YUY2), this is the case. However, it is also used from LXCopyPlanar to copy the planes of I420 images. In this case, it is on an 8bpp input plane. Running at 16bpp causes twice as much data to be copied, and ultimately causes a buffer overflow leading to crashes such as http://dev.laptop.org/ticket/10260 Fix this by deriving the BPP from the input image parameters.
-rw-r--r--src/lx_video.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/lx_video.c b/src/lx_video.c
index 702139e..f917ef0 100644
--- a/src/lx_video.c
+++ b/src/lx_video.c
@@ -119,7 +119,7 @@ LXCopyFromSys(GeodeRec * pGeode, unsigned char *src, unsigned int dst,
{
gp_declare_blt(0);
- gp_set_bpp(16);
+ gp_set_bpp((srcPitch / w) << 3);
gp_set_raster_operation(0xCC);
gp_set_strides(dstPitch, srcPitch);