xf86-video-intel: src/intel_uxa.c

[Chris Wilson]

 src/intel_uxa.c |   19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

New commits:
commit e8f41c371024e2f3845c7652b22af8f5900200f2
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Sun Dec 5 21:37:23 2010 +0000

    uxa: Prevent reading past the last byte on upload/download
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=29752
    Reported-by: Sergey Samokhin <prikrutil at gmail.com>
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/intel_uxa.c b/src/intel_uxa.c
index 439d109..3b3a207 100644
--- a/src/intel_uxa.c
+++ b/src/intel_uxa.c
@@ -727,16 +727,17 @@ static Bool intel_uxa_pixmap_put_image(PixmapPtr pixmap,
 {
 	struct intel_pixmap *priv = intel_get_pixmap_private(pixmap);
 	int stride = intel_pixmap_pitch(pixmap);
+	int cpp = pixmap->drawable.bitsPerPixel/8;
 	int ret = FALSE;
 
 	if (priv == NULL || priv->bo == NULL)
 		return FALSE;
 
-	if (src_pitch == stride && w == pixmap->drawable.width && priv->tiling == I915_TILING_NONE) {
-		ret = drm_intel_bo_subdata(priv->bo, y * stride, stride * h, src) == 0;
+	if (priv->tiling == I915_TILING_NONE &&
+	    (h == 1 || (src_pitch == stride && w == pixmap->drawable.width))) {
+		return drm_intel_bo_subdata(priv->bo, y*stride + x*cpp, stride*(h-1) + w*cpp, src) == 0;
 	} else if (drm_intel_gem_bo_map_gtt(priv->bo) == 0) {
 		char *dst = priv->bo->virtual;
-		int cpp = pixmap->drawable.bitsPerPixel/8;
 		int row_length = w * cpp;
 		int num_rows = h;
 		if (row_length == src_pitch && src_pitch == stride)
@@ -843,17 +844,17 @@ static Bool intel_uxa_pixmap_get_image(PixmapPtr pixmap,
 {
 	struct intel_pixmap *priv = intel_get_pixmap_private(pixmap);
 	int stride = intel_pixmap_pitch(pixmap);
+	int cpp = pixmap->drawable.bitsPerPixel/8;
 
-	if (dst_pitch == stride && w == pixmap->drawable.width) {
-		return drm_intel_bo_get_subdata(priv->bo, y * stride, stride * h, dst) == 0;
+	/* assert(priv->tiling == I915_TILING_NONE); */
+	if (h == 1 || (dst_pitch == stride && w == pixmap->drawable.width)) {
+		return drm_intel_bo_get_subdata(priv->bo, y*stride + x*cpp, (h-1)*stride + w*cpp, dst) == 0;
 	} else {
 		char *src;
-		int cpp;
 
-		if (drm_intel_bo_map(priv->bo, FALSE))
+		if (drm_intel_gem_bo_map_gtt(priv->bo))
 		    return FALSE;
 
-		cpp = pixmap->drawable.bitsPerPixel/8;
 		src = (char *) priv->bo->virtual + y * stride + x * cpp;
 		w *= cpp;
 		do {
@@ -862,7 +863,7 @@ static Bool intel_uxa_pixmap_get_image(PixmapPtr pixmap,
 			dst += dst_pitch;
 		} while (--h);
 
-		drm_intel_bo_unmap(priv->bo);
+		drm_intel_gem_bo_unmap_gtt(priv->bo);
 
 		return TRUE;
 	}