Attachment 30004 Details for Bug 24274 – Assert that the read/write pointer is within bounds

[patch] Assert that the read/write pointer is within bounds

fb-assert.patch (text/plain), 1.67 KB, created by Chris Wilson on 2009-10-02 17:04:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Wilson

Created: 2009-10-02 17:04:52 UTC

Size: 1.67 KB

patch

obsolete

>diff --git a/fb/fbseg.c b/fb/fbseg.c
>index 80ce740..6c2c7cf 100644
>--- a/fb/fbseg.c
>+++ b/fb/fbseg.c
>@@ -47,7 +47,7 @@ fbBresSolid (DrawablePtr    pDrawable,
> 	     int	    e3,
> 	     int	    len)
> {
>-    FbStip	*dst;
>+    FbStip	*dst, *start, *end;
>     FbStride	dstStride;
>     int		dstBpp;
>     int		dstXoff, dstYoff;
>@@ -56,12 +56,15 @@ fbBresSolid (DrawablePtr    pDrawable,
>     FbStip	xor = (FbStip) pPriv->xor;
>     FbStip	mask, mask0;
>     FbStip	bits;
>-    
>+
>     fbGetStipDrawable (pDrawable, dst, dstStride, dstBpp, dstXoff, dstYoff);
>+    start = dst;
>+    end = dst + dstStride * pDrawable->height;
>     dst += ((y1 + dstYoff) * dstStride);
>     x1 = (x1 + dstXoff) * dstBpp;
>     dst += x1 >> FB_STIP_SHIFT;
>     x1 &= FB_STIP_MASK;
>+    assert (dst >= start && dst < end);
>     mask0 = FbStipMask(0, dstBpp);
>     mask = FbStipRight (mask0, x1);
>     if (signdx < 0)
>@@ -77,6 +80,7 @@ fbBresSolid (DrawablePtr    pDrawable,
> 	    mask = fbBresShiftMask(mask,signdx,dstBpp);
> 	    if (!mask)
> 	    {
>+		assert (dst >= start && dst < end);
> 		WRITE(dst, FbDoMaskRRop (READ(dst), and, xor, bits));
> 		bits = 0;
> 		dst += signdx;
>@@ -85,19 +89,23 @@ fbBresSolid (DrawablePtr    pDrawable,
> 	    e += e1;
> 	    if (e >= 0)
> 	    {
>+		assert (dst >= start && dst < end);
> 		WRITE(dst, FbDoMaskRRop (READ(dst), and, xor, bits));
> 		bits = 0;
> 		dst += dstStride;
> 		e += e3;
> 	    }
> 	}
>-	if (bits)
>+	if (bits) {
>+	    assert (dst >= start && dst < end);
> 	    WRITE(dst, FbDoMaskRRop (READ(dst), and, xor, bits));
>+	}
>     }
>     else
>     {
> 	while (len--)
> 	{
>+	    assert (dst >= start && dst < end);
> 	    WRITE(dst, FbDoMaskRRop (READ(dst), and, xor, mask));
> 	    dst += dstStride;
> 	    e += e1;

Actions: View | Splinter Review

Attachments on bug 24274: 29995 | 30003 | 30004 | 56113 | 57155 | 59095

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.