From 32010ed86bb8f28d3b02e1e54a592d79b92b2b98 Mon Sep 17 00:00:00 2001 From: Chris Wilson Date: Wed, 22 Jan 2014 16:26:14 +0000 Subject: [PATCH] sna: Assert that the fill box is within bounds References: https://bugs.freedesktop.org/show_bug.cgi?id=73811 Signed-off-by: Chris Wilson --- src/sna/sna_blt.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/src/sna/sna_blt.c b/src/sna/sna_blt.c index 32179bfd..7f3fc3e8 100644 --- a/src/sna/sna_blt.c +++ b/src/sna/sna_blt.c @@ -944,6 +944,11 @@ blt_composite_fill_box__cpu(struct sna *sna, const struct sna_composite_op *op, const BoxRec *box) { + assert(box->x1 >= 0); + assert(box->y1 >= 0); + assert(box->x2 <= op->dst.pixmap->drawable.width); + assert(box->y2 <= op->dst.pixmap->drawable.height); + pixman_fill(op->dst.pixmap->devPrivate.ptr, op->dst.pixmap->devKind / sizeof(uint32_t), op->dst.pixmap->drawable.bitsPerPixel, @@ -957,6 +962,11 @@ blt_composite_fill_boxes__cpu(struct sna *sna, const BoxRec *box, int n) { do { + assert(box->x1 >= 0); + assert(box->y1 >= 0); + assert(box->x2 <= op->dst.pixmap->drawable.width); + assert(box->y2 <= op->dst.pixmap->drawable.height); + pixman_fill(op->dst.pixmap->devPrivate.ptr, op->dst.pixmap->devKind / sizeof(uint32_t), op->dst.pixmap->drawable.bitsPerPixel, @@ -1327,9 +1337,9 @@ prepare_blt_clear(struct sna *sna, op->done = nop_done; if (!sna_blt_fill_init(sna, &op->u.blt, - op->dst.bo, - op->dst.pixmap->drawable.bitsPerPixel, - GXclear, 0)) + op->dst.bo, + op->dst.pixmap->drawable.bitsPerPixel, + GXclear, 0)) return false; return begin_blt(sna, op);