xf86-video-intel: src/sna/sna_accel.c

[Chris Wilson]

 src/sna/sna_accel.c |   18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

New commits:
commit 0afb7efe8c48b5fc839e2137e870bea0f5fb3c9c
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Sun Sep 23 09:41:59 2012 +0100

    sna: Avoid overflows when translating the box16 extents during a copy
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c
index 58029c8..a2afce0 100644
--- a/src/sna/sna_accel.c
+++ b/src/sna/sna_accel.c
@@ -3332,6 +3332,16 @@ static int16_t bound(int16_t a, uint16_t b)
 	return v;
 }
 
+static int16_t clamp(int16_t a, int16_t b)
+{
+	int v = (int)a + (int)b;
+	if (v > MAXSHORT)
+		return MAXSHORT;
+	if (v < MINSHORT)
+		return MINSHORT;
+	return v;
+}
+
 static inline bool box32_to_box16(const Box32Rec *b32, BoxRec *b16)
 {
 	b16->x1 = b32->x1;
@@ -4880,10 +4890,10 @@ sna_do_copy(DrawablePtr src, DrawablePtr dst, GCPtr gc,
 		return NULL;
 	}
 
-	region.extents.x1 += sx - dx;
-	region.extents.x2 += sx - dx;
-	region.extents.y1 += sy - dy;
-	region.extents.y2 += sy - dy;
+	region.extents.x1 = clamp(region.extents.x1, sx - dx);
+	region.extents.x2 = clamp(region.extents.x2, sx - dx);
+	region.extents.y1 = clamp(region.extents.y1, sy - dy);
+	region.extents.y2 = clamp(region.extents.y2, sy - dy);
 
 	/* Compute source clip region */
 	clip = NULL;