Attachment 37578 Details for Bug 29391 – fix

[patch] fix

set_bpp_from_source_image.patch (text/plain), 1.05 KB, created by Daniel Drake on 2010-08-04 19:44:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Daniel Drake

Created: 2010-08-04 19:44:09 UTC

Size: 1.05 KB

patch

obsolete

>From: Daniel Drake <dsd@laptop.org>
>
>http://lists.x.org/archives/xorg-driver-geode/2010-August/000938.html
>https://bugs.freedesktop.org/show_bug.cgi?id=29391
>
>LXCopyFromSys currently is hardcoded to operate on 16bpp data.
>And indeed, when working with packed data (e.g. YUY2), this is the case.
>
>However, it is also used from LXCopyPlanar to copy the planes of I420
>images. In this case, it is on an 8bpp input plane.
>
>Running at 16bpp causes twice as much data to be copied, and ultimately
>causes a buffer overflow leading to crashes such as
>http://dev.laptop.org/ticket/10260
>
>Fix this by deriving the BPP from the input image parameters.
>
>Index: xf86-video-geode-2.11.2/src/lx_video.c
>===================================================================
>--- xf86-video-geode-2.11.2.orig/src/lx_video.c
>+++ xf86-video-geode-2.11.2/src/lx_video.c
>@@ -120,7 +120,7 @@ LXCopyFromSys(GeodeRec * pGeode, unsigne
> {
> 
>     gp_declare_blt(0);
>-    gp_set_bpp(16);
>+    gp_set_bpp((srcPitch / w) << 3);
> 
>     gp_set_raster_operation(0xCC);
>     gp_set_strides(dstPitch, srcPitch);

Actions: View | Splinter Review

Attachments on bug 29391: 37578 | 38497

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.