diff options
author | Alex Deucher <alexdeucher@gmail.com> | 2009-02-09 19:57:30 -0500 |
---|---|---|
committer | Alex Deucher <alexdeucher@gmail.com> | 2009-02-09 19:57:30 -0500 |
commit | 038de45b4c09356d0b46a03f6e69eece6aaf907b (patch) | |
tree | d797cbeeb15e98e77b3eddc8e13436e5356c905f | |
parent | 613299dcc30971e381b120b3bc3412d02e2b9aea (diff) |
R6xx/R7xx: Add checks to make sure we don't overrun VB space
-rw-r--r-- | src/r600_exa.c | 20 | ||||
-rw-r--r-- | src/r600_textured_videofuncs.c | 5 |
2 files changed, 25 insertions, 0 deletions
diff --git a/src/r600_exa.c b/src/r600_exa.c index 9503485..45103c4 100644 --- a/src/r600_exa.c +++ b/src/r600_exa.c @@ -260,6 +260,11 @@ R600Solid(PixmapPtr pPix, int x1, int y1, int x2, int y2) struct r6xx_solid_vertex vertex[3]; struct r6xx_solid_vertex *solid_vb = (pointer)((char*)accel_state->ib->address + (accel_state->ib->total / 2)); + if (((accel_state->vb_index + 3) * 8) > (accel_state->ib->total / 2)) { + ErrorF("Ran out of VB space!\n"); + return; + } + vertex[0].x = (float)x1; vertex[0].y = (float)y1; @@ -602,6 +607,11 @@ R600AppendCopyVertex(ScrnInfoPtr pScrn, struct r6xx_copy_vertex *copy_vb = (pointer)((char*)accel_state->ib->address + (accel_state->ib->total / 2)); struct r6xx_copy_vertex vertex[3]; + if (((accel_state->vb_index + 3) * 16) > (accel_state->ib->total / 2)) { + ErrorF("Ran out of VB space!\n"); + return; + } + vertex[0].x = (float)dstX; vertex[0].y = (float)dstY; vertex[0].s = (float)srcX; @@ -1905,6 +1915,11 @@ static void R600Composite(PixmapPtr pDst, struct r6xx_comp_mask_vertex vertex[3]; xPointFixed maskTopLeft, maskTopRight, maskBottomLeft, maskBottomRight; + if (((accel_state->vb_index + 3) * 24) > (accel_state->ib->total / 2)) { + ErrorF("Ran out of VB space!\n"); + return; + } + maskTopLeft.x = IntToxFixed(maskX); maskTopLeft.y = IntToxFixed(maskY); maskTopRight.x = IntToxFixed(maskX + w); @@ -1961,6 +1976,11 @@ static void R600Composite(PixmapPtr pDst, (pointer)((char*)accel_state->ib->address + (accel_state->ib->total / 2)); struct r6xx_comp_vertex vertex[3]; + if (((accel_state->vb_index + 3) * 16) > (accel_state->ib->total / 2)) { + ErrorF("Ran out of VB space!\n"); + return; + } + vertex[0].x = (float)dstX; vertex[0].y = (float)dstY; vertex[0].src_s = xFixedToFloat(srcTopLeft.x) / accel_state->texW[0]; diff --git a/src/r600_textured_videofuncs.c b/src/r600_textured_videofuncs.c index 1fcc93c..7916871 100644 --- a/src/r600_textured_videofuncs.c +++ b/src/r600_textured_videofuncs.c @@ -411,6 +411,11 @@ R600DisplayTexturedVideo(ScrnInfoPtr pScrn, struct RHDPortPriv *pPriv) struct r6xx_copy_vertex *xv_vb = (pointer)((char*)accel_state->ib->address + (accel_state->ib->total / 2)); struct r6xx_copy_vertex vertex[3]; + if (((accel_state->vb_index + 3) * 16) > (accel_state->ib->total / 2)) { + ErrorF("Ran out of VB space!\n"); + break; + } + dstX = pBox->x1 + dstxoff; dstY = pBox->y1 + dstyoff; dstw = pBox->x2 - pBox->x1; |