Bug 16624 - invalid pointer passed to RRChangeOutputProperty
Summary: invalid pointer passed to RRChangeOutputProperty
Status: RESOLVED FIXED
Alias: None
Product: xorg
Classification: Unclassified
Component: Driver/nouveau (show other bugs)
Version: git
Hardware: All All
: medium normal
Assignee: Nouveau Project
QA Contact: Xorg Project Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-07-05 22:43 UTC by Danny
Modified: 2008-07-30 22:56 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments
proposed patch for the issue (538 bytes, patch)
2008-07-05 22:43 UTC, Danny
no flags Details | Splinter Review

Description Danny 2008-07-05 22:43:09 UTC
Created attachment 17547 [details] [review]
proposed patch for the issue

In nv_output:

error = RRChangeOutputProperty(output->randr_output, dithering_atom,
                                        XA_INTEGER, 32, PropModeReplace, 1, &nv_output->dithering,FALSE, FALSE);

&nv_output->dithering is a Boolean, but the property is set up as int32. On big endian systems, this results in the property set being 0x1000000 instead of 0x1. This currently fails the range check (it can only be 1 or 0). Leading to an error returned above which made me notice the issue.

Actually I think it may be an idea if X would check the type of the pointer passed to RRChangeOutputProperty and return a better error if it is not equal to the type (this problem would go unnoticed without the range check in nv_output's set_property function), thus I add a cc to keithp about that.

To fix the problem in nouveau, either the property should be set up as Bool, or we need to do an explicit cast. I provide a patch for the latter (because I am not sure if we want more than 2 states for this property in the future). Let me know if the former is preferred.


Cheers,

danny
Comment 1 Danny 2008-07-30 22:56:08 UTC
Fix commited by Stuart (thanks!) in 140c36ed936f4f28842af88efdd8b824c01bb097

danny
Comment 2 Danny 2008-07-30 22:56:41 UTC
Fix commited by Stuart (thanks!) in 140c36ed936f4f28842af88efdd8b824c01bb097

danny


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.