From: Daniel Drake <dsd@laptop.org>

http://lists.x.org/archives/xorg-driver-geode/2010-August/000938.html
https://bugs.freedesktop.org/show_bug.cgi?id=29391

LXCopyFromSys currently is hardcoded to operate on 16bpp data.
And indeed, when working with packed data (e.g. YUY2), this is the case.

However, it is also used from LXCopyPlanar to copy the planes of I420
images. In this case, it is on an 8bpp input plane.

Running at 16bpp causes twice as much data to be copied, and ultimately
causes a buffer overflow leading to crashes such as
http://dev.laptop.org/ticket/10260

Fix this by deriving the BPP from the input image parameters.

Index: xf86-video-geode-2.11.2/src/lx_video.c
===================================================================
--- xf86-video-geode-2.11.2.orig/src/lx_video.c
+++ xf86-video-geode-2.11.2/src/lx_video.c
@@ -120,7 +120,7 @@ LXCopyFromSys(GeodeRec * pGeode, unsigne
 {
 
     gp_declare_blt(0);
-    gp_set_bpp(16);
+    gp_set_bpp((srcPitch / w) << 3);
 
     gp_set_raster_operation(0xCC);
     gp_set_strides(dstPitch, srcPitch);