[PATCH] render: Avoid infinite loops in alpha map handling (#23581)

[Keith Packard]

On Tue, 11 May 2010 14:12:52 -0400, Adam Jackson <ajax at nwnk.net> wrote:

> I just want it to not trivially crash my server.  I could care less
> about correctness for this.

Then I think the only needed fix is to check for the trivial loop:

index 48693b8..78e8c9b 100644
--- a/render/picture.c
+++ b/render/picture.c
@@ -1131,6 +1131,8 @@ ChangePicture (PicturePtr	pPicture,
 		    pAlpha = NEXT_PTR(PicturePtr);
 		if (!error)
 		{
+		    if (pAlpha && pAlpha->pDrawable == pPicture->pDrawable)
+			pAlpha = NULL;
 		    if (pAlpha && pAlpha->pDrawable->type == DRAWABLE_PIXMAP)
 			pAlpha->refcnt++;
 		    if (pPicture->alphaMap)

Is there somewhere in the server that is recursing through the alphaMap?
fb doesn't, and I don't know of any acceleration code that deals with alphaMap.

-- 
keith.packard at intel.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://lists.x.org/archives/xorg-devel/attachments/20100512/208576dc/attachment-0001.pgp>