diff options
author | Chris Wilson <chris@chris-wilson.co.uk> | 2012-01-19 00:36:52 +0000 |
---|---|---|
committer | Chris Wilson <chris@chris-wilson.co.uk> | 2012-01-19 00:45:08 +0000 |
commit | 17efdbc48c964d9d7b0af630c13a6ceb62fb1787 (patch) | |
tree | 278d8bb6c4d9d2171bcecafadfd7b462033bb6a3 | |
parent | fb07243c9a08b24e2dc03b86dc16d3cd72cbfcba (diff) |
sna: Clip damage area with source extents for fallback
The damage tracking code asserts that it only handles clip regions.
However, sna_copy_area() was failing to ensure that its damage region
was being clipped by the source drawable, leading to out of bounds reads
during forced fallback.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
-rw-r--r-- | src/sna/sna_accel.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c index dc9ac64a..f8688c9e 100644 --- a/src/sna/sna_accel.c +++ b/src/sna/sna_accel.c @@ -3361,6 +3361,18 @@ sna_copy_area(DrawablePtr src, DrawablePtr dst, GCPtr gc, region.extents.y2 = region.extents.y1 + height; region.data = NULL; RegionIntersect(®ion, ®ion, gc->pCompositeClip); + + { + RegionRec clip; + + clip.extents.x1 = -(src_x - dst_x - dst->x + src->x); + clip.extents.y1 = -(src_y - dst_y - dst->y + src->y); + clip.extents.x2 = clip.extents.x1 + src->width; + clip.extents.y2 = clip.extents.y1 + src->height; + clip.data = NULL; + + RegionIntersect(®ion, ®ion, &clip); + } if (!RegionNotEmpty(®ion)) return NULL; |