diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2011-11-07 20:00:20 +0000 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2011-11-07 20:00:20 +0000 |
| commit | 65a440543b13e3e605a4a2d6209a460fbbe55736 (patch) | |
| tree | 877ef417b377fbef9355c5bc5d56e870f8b76162 | |
| parent | d4edbd480445bc6aadd2c9f17262bd4b3eefbca6 (diff) | |
sna: Fix 16-bit overflow of rowlength for memcpy
Reported-by: Clemens Eisserer <linuxhippy@gmail.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=42619
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
| -rw-r--r-- | src/sna/blt.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/src/sna/blt.c b/src/sna/blt.c index 5dc318ca..ca154532 100644 --- a/src/sna/blt.c +++ b/src/sna/blt.c @@ -45,6 +45,7 @@ memcpy_blt(const void *src, void *dst, int bpp, { uint8_t *src_bytes; uint8_t *dst_bytes; + int byte_width; assert(width && height); assert(bpp >= 8); @@ -53,18 +54,18 @@ memcpy_blt(const void *src, void *dst, int bpp, __FUNCTION__, src_x, src_y, dst_x, dst_y, width, height, src_stride, dst_stride)); bpp /= 8; - width *= bpp; src_bytes = (uint8_t *)src + src_stride * src_y + src_x * bpp; dst_bytes = (uint8_t *)dst + dst_stride * dst_y + dst_x * bpp; - if (width == src_stride && width == dst_stride) { - memcpy(dst_bytes, src_bytes, width * height); + byte_width = width * bpp; + if (byte_width == src_stride && byte_width == dst_stride) { + memcpy(dst_bytes, src_bytes, byte_width * height); return; } do { - memcpy(dst_bytes, src_bytes, width); + memcpy(dst_bytes, src_bytes, byte_width); src_bytes += src_stride; dst_bytes += dst_stride; } while (--height); |