Attachment 14356 Details for Bug 14426 – Do not access beyond source pixmap in NVAccelUploadIFC

[patch] Do not access beyond source pixmap in NVAccelUploadIFC

0001-Do-not-access-beyond-source-pixmap-in-NVAccelUploadI.patch (text/plain), 1.62 KB, created by Jaime Velasco Juan on 2008-02-16 07:10:16 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jaime Velasco Juan

Created: 2008-02-16 07:10:16 UTC

Size: 1.62 KB

patch

obsolete

>From d6d41ced2a780ac9db08d330cade6846c0679e03 Mon Sep 17 00:00:00 2001
>From: Jaime Velasco Juan <jsagarribay@gmail.com>
>Date: Sat, 16 Feb 2008 15:01:23 +0000
>Subject: [PATCH] Do not access beyond source pixmap in NVAccelUploadIFC
>
>---
> src/nv_exa.c |   12 ++++++++++++
> 1 files changed, 12 insertions(+), 0 deletions(-)
>
>diff --git a/src/nv_exa.c b/src/nv_exa.c
>index ff36d26..d74914f 100644
>--- a/src/nv_exa.c
>+++ b/src/nv_exa.c
>@@ -477,6 +477,7 @@ NVAccelUploadIFC(ScrnInfoPtr pScrn, const char *src, int src_pitch,
> 	NVPtr pNv = NVPTR(pScrn);
> 	int line_len = w * cpp;
> 	int iw, id, surf_fmt, ifc_fmt;
>+	int padbytes;
> 
> 	if (pNv->Architecture >= NV_ARCH_50)
> 		return FALSE;
>@@ -502,6 +503,7 @@ NVAccelUploadIFC(ScrnInfoPtr pScrn, const char *src, int src_pitch,
> 
> 	/* Pad out input width to cover both COLORA() and COLORB() */
> 	iw  = (line_len + 7) & ~7;
>+	padbytes = iw - line_len;
> 	id  = iw / 4; /* line push size */
> 	iw /= cpp;
> 
>@@ -521,6 +523,8 @@ NVAccelUploadIFC(ScrnInfoPtr pScrn, const char *src, int src_pitch,
> 	OUT_RING  ((h << 16) | w); /* width/height out */
> 	OUT_RING  ((h << 16) | iw); /* width/height in */
> 
>+	if (padbytes)
>+		h--;
> 	while (h--) {
> 		/* send a line */
> 		BEGIN_RING(NvImageFromCpu, NV01_IMAGE_FROM_CPU_COLOR(0), id);
>@@ -528,6 +532,14 @@ NVAccelUploadIFC(ScrnInfoPtr pScrn, const char *src, int src_pitch,
> 
> 		src += src_pitch;
> 	}
>+	if (padbytes) {
>+		char padding[8];
>+		int aux = (padbytes + 7) >> 2;
>+		BEGIN_RING(NvImageFromCpu, NV01_IMAGE_FROM_CPU_COLOR(0), id);
>+		OUT_RINGp (src, id - aux);
>+		memcpy(padding, src + (id - aux) * 4, padbytes);
>+		OUT_RINGp (padding, aux);
>+	}
> 
> 	return TRUE;
> }
>-- 
>1.5.4
>

Actions: View | Splinter Review

Attachments on bug 14426: 14218 | 14237 | 14356

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.