xf86-video-intel: src/sna/sna_blt.c

[Chris Wilson]

 src/sna/sna_blt.c |   16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

New commits:
commit 32010ed86bb8f28d3b02e1e54a592d79b92b2b98
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Wed Jan 22 16:26:14 2014 +0000

    sna: Assert that the fill box is within bounds
    
    References: https://bugs.freedesktop.org/show_bug.cgi?id=73811
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/sna_blt.c b/src/sna/sna_blt.c
index 32179bf..7f3fc3e 100644
--- a/src/sna/sna_blt.c
+++ b/src/sna/sna_blt.c
@@ -944,6 +944,11 @@ blt_composite_fill_box__cpu(struct sna *sna,
 			    const struct sna_composite_op *op,
 			    const BoxRec *box)
 {
+	assert(box->x1 >= 0);
+	assert(box->y1 >= 0);
+	assert(box->x2 <= op->dst.pixmap->drawable.width);
+	assert(box->y2 <= op->dst.pixmap->drawable.height);
+
 	pixman_fill(op->dst.pixmap->devPrivate.ptr,
 		    op->dst.pixmap->devKind / sizeof(uint32_t),
 		    op->dst.pixmap->drawable.bitsPerPixel,
@@ -957,6 +962,11 @@ blt_composite_fill_boxes__cpu(struct sna *sna,
 			      const BoxRec *box, int n)
 {
 	do {
+		assert(box->x1 >= 0);
+		assert(box->y1 >= 0);
+		assert(box->x2 <= op->dst.pixmap->drawable.width);
+		assert(box->y2 <= op->dst.pixmap->drawable.height);
+
 		pixman_fill(op->dst.pixmap->devPrivate.ptr,
 			    op->dst.pixmap->devKind / sizeof(uint32_t),
 			    op->dst.pixmap->drawable.bitsPerPixel,
@@ -1327,9 +1337,9 @@ prepare_blt_clear(struct sna *sna,
 	op->done = nop_done;
 
 	if (!sna_blt_fill_init(sna, &op->u.blt,
-				 op->dst.bo,
-				 op->dst.pixmap->drawable.bitsPerPixel,
-				 GXclear, 0))
+			       op->dst.bo,
+			       op->dst.pixmap->drawable.bitsPerPixel,
+			       GXclear, 0))
 		return false;
 
 	return begin_blt(sna, op);