diff --git a/src/sna/blt.c b/src/sna/blt.c index ac20372e..1d5cace0 100644 --- a/src/sna/blt.c +++ b/src/sna/blt.c @@ -50,6 +50,8 @@ memcpy_blt(const void *src, void *dst, int bpp, assert(width && height); assert(bpp >= 8); + assert((src_x + width) * bpp <= 8 * src_stride); + assert((dst_x + width) * bpp <= 8 * dst_stride); DBG(("%s: src=(%d, %d), dst=(%d, %d), size=%dx%d, pitch=%d/%d\n", __FUNCTION__, src_x, src_y, dst_x, dst_y, width, height, src_stride, dst_stride)); diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c index a6353723..aa12ec57 100644 --- a/src/sna/sna_accel.c +++ b/src/sna/sna_accel.c @@ -1053,6 +1053,16 @@ sna_put_image_blt(DrawablePtr drawable, GCPtr gc, RegionPtr region, box = REGION_RECTS(region); n = REGION_NUM_RECTS(region); do { + assert(box->x1 >= 0); + assert(box->y1 >= 0); + assert(box->x2 <= pixmap->drawable.width); + assert(box->y2 <= pixmap->drawable.height); + + assert(box->x1 - x >= 0); + assert(box->y1 - y >= 0); + assert(box->x2 - x <= w); + assert(box->y2 - y <= h); + memcpy_blt(bits, dst_bits, pixmap->drawable.bitsPerPixel, stride, dst_stride,