diff options
| author | Daniel Drake <dsd@laptop.org> | 2010-08-05 08:08:06 +0300 |
|---|---|---|
| committer | Martin-Éric Racine <q-funk@iki.fi> | 2010-08-05 08:08:06 +0300 |
| commit | e9effca821c1d604aeffeb3d3e7a49539485117d (patch) | |
| tree | af4736bfab1d7acf065b210e36344c55b3d082b5 | |
| parent | f0df6821c454d2b174a071fd846b399e8c2f98f5 (diff) | |
http://lists.x.org/archives/xorg-driver-geode/2010-August/000938.html
https://bugs.freedesktop.org/show_bug.cgi?id=29391
LXCopyFromSys currently is hardcoded to operate on 16bpp data.
And indeed, when working with packed data (e.g. YUY2), this is the case.
However, it is also used from LXCopyPlanar to copy the planes of I420
images. In this case, it is on an 8bpp input plane.
Running at 16bpp causes twice as much data to be copied, and ultimately
causes a buffer overflow leading to crashes such as
http://dev.laptop.org/ticket/10260
Fix this by deriving the BPP from the input image parameters.
| -rw-r--r-- | src/lx_video.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/lx_video.c b/src/lx_video.c index 702139e..f917ef0 100644 --- a/src/lx_video.c +++ b/src/lx_video.c @@ -119,7 +119,7 @@ LXCopyFromSys(GeodeRec * pGeode, unsigned char *src, unsigned int dst, { gp_declare_blt(0); - gp_set_bpp(16); + gp_set_bpp((srcPitch / w) << 3); gp_set_raster_operation(0xCC); gp_set_strides(dstPitch, srcPitch); |