summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChris Wilson <chris@chris-wilson.co.uk>2012-01-19 00:36:52 +0000
committerChris Wilson <chris@chris-wilson.co.uk>2012-01-19 00:45:08 +0000
commit17efdbc48c964d9d7b0af630c13a6ceb62fb1787 (patch)
tree278d8bb6c4d9d2171bcecafadfd7b462033bb6a3
parentfb07243c9a08b24e2dc03b86dc16d3cd72cbfcba (diff)
sna: Clip damage area with source extents for fallback
The damage tracking code asserts that it only handles clip regions. However, sna_copy_area() was failing to ensure that its damage region was being clipped by the source drawable, leading to out of bounds reads during forced fallback. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
-rw-r--r--src/sna/sna_accel.c12
1 files changed, 12 insertions, 0 deletions
diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c
index dc9ac64a..f8688c9e 100644
--- a/src/sna/sna_accel.c
+++ b/src/sna/sna_accel.c
@@ -3361,6 +3361,18 @@ sna_copy_area(DrawablePtr src, DrawablePtr dst, GCPtr gc,
region.extents.y2 = region.extents.y1 + height;
region.data = NULL;
RegionIntersect(&region, &region, gc->pCompositeClip);
+
+ {
+ RegionRec clip;
+
+ clip.extents.x1 = -(src_x - dst_x - dst->x + src->x);
+ clip.extents.y1 = -(src_y - dst_y - dst->y + src->y);
+ clip.extents.x2 = clip.extents.x1 + src->width;
+ clip.extents.y2 = clip.extents.y1 + src->height;
+ clip.data = NULL;
+
+ RegionIntersect(&region, &region, &clip);
+ }
if (!RegionNotEmpty(&region))
return NULL;