[Mesa-dev] [PATCH] st/va: Fix potential buffer overread
Kristian Høgsberg
hoegsberg at gmail.com
Tue Apr 24 23:09:40 UTC 2018
On Tue, Apr 24, 2018 at 4:02 PM Drew Davenport <ddavenport at chromium.org>
wrote:
> VASurfaceAttribExternalBuffers.pitches is indexed by
> plane. Current implementation only supports single plane layout.
Reviewed-by: Kristian H. Kristensen <hoegsberg at chromium.org>
> ---
> src/gallium/state_trackers/va/surface.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> diff --git a/src/gallium/state_trackers/va/surface.c
b/src/gallium/state_trackers/va/surface.c
> index 8604136944..6fe21b89e5 100644
> --- a/src/gallium/state_trackers/va/surface.c
> +++ b/src/gallium/state_trackers/va/surface.c
> @@ -574,7 +574,7 @@ suface_from_external_memory(VADriverContextP ctx,
vlVaSurface *surface,
> memset(&whandle, 0, sizeof(struct winsys_handle));
> whandle.type = DRM_API_HANDLE_TYPE_FD;
> whandle.handle = memory_attibute->buffers[index];
> - whandle.stride = memory_attibute->pitches[index];
> + whandle.stride = memory_attibute->pitches[0];
> resource = pscreen->resource_from_handle(pscreen, &res_templ,
&whandle,
PIPE_HANDLE_USAGE_READ_WRITE);
> --
> 2.17.0.441.gb46fe60e1d-goog
> _______________________________________________
> mesa-dev mailing list
> mesa-dev at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/mesa-dev
More information about the mesa-dev
mailing list