diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2014-01-22 16:26:14 +0000 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2014-01-22 16:31:22 +0000 |
| commit | 32010ed86bb8f28d3b02e1e54a592d79b92b2b98 (patch) | |
| tree | ebcb0811debc08552ce9daa9f5368cfea3f3dd1a | |
| parent | 29e11e2e6f80f6485ed69ea72e09e8d9b31fd8e8 (diff) | |
sna: Assert that the fill box is within bounds
References: https://bugs.freedesktop.org/show_bug.cgi?id=73811
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
| -rw-r--r-- | src/sna/sna_blt.c | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/src/sna/sna_blt.c b/src/sna/sna_blt.c index 32179bfd..7f3fc3e8 100644 --- a/src/sna/sna_blt.c +++ b/src/sna/sna_blt.c @@ -944,6 +944,11 @@ blt_composite_fill_box__cpu(struct sna *sna, const struct sna_composite_op *op, const BoxRec *box) { + assert(box->x1 >= 0); + assert(box->y1 >= 0); + assert(box->x2 <= op->dst.pixmap->drawable.width); + assert(box->y2 <= op->dst.pixmap->drawable.height); + pixman_fill(op->dst.pixmap->devPrivate.ptr, op->dst.pixmap->devKind / sizeof(uint32_t), op->dst.pixmap->drawable.bitsPerPixel, @@ -957,6 +962,11 @@ blt_composite_fill_boxes__cpu(struct sna *sna, const BoxRec *box, int n) { do { + assert(box->x1 >= 0); + assert(box->y1 >= 0); + assert(box->x2 <= op->dst.pixmap->drawable.width); + assert(box->y2 <= op->dst.pixmap->drawable.height); + pixman_fill(op->dst.pixmap->devPrivate.ptr, op->dst.pixmap->devKind / sizeof(uint32_t), op->dst.pixmap->drawable.bitsPerPixel, @@ -1327,9 +1337,9 @@ prepare_blt_clear(struct sna *sna, op->done = nop_done; if (!sna_blt_fill_init(sna, &op->u.blt, - op->dst.bo, - op->dst.pixmap->drawable.bitsPerPixel, - GXclear, 0)) + op->dst.bo, + op->dst.pixmap->drawable.bitsPerPixel, + GXclear, 0)) return false; return begin_blt(sna, op); |