From 4d4aca21fd32a367d78dfaf1c23b4faeabe36428 Mon Sep 17 00:00:00 2001 From: Chris Wilson Date: Wed, 14 Sep 2011 13:06:26 +0100 Subject: [PATCH] sna: assert that the memcpy upload path points to valid regions Signed-off-by: Chris Wilson --- src/sna/blt.c | 2 ++ src/sna/sna_accel.c | 10 ++++++++++ 2 files changed, 12 insertions(+) diff --git a/src/sna/blt.c b/src/sna/blt.c index ac20372e..1d5cace0 100644 --- a/src/sna/blt.c +++ b/src/sna/blt.c @@ -50,6 +50,8 @@ memcpy_blt(const void *src, void *dst, int bpp, assert(width && height); assert(bpp >= 8); + assert((src_x + width) * bpp <= 8 * src_stride); + assert((dst_x + width) * bpp <= 8 * dst_stride); DBG(("%s: src=(%d, %d), dst=(%d, %d), size=%dx%d, pitch=%d/%d\n", __FUNCTION__, src_x, src_y, dst_x, dst_y, width, height, src_stride, dst_stride)); diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c index a6353723..aa12ec57 100644 --- a/src/sna/sna_accel.c +++ b/src/sna/sna_accel.c @@ -1053,6 +1053,16 @@ sna_put_image_blt(DrawablePtr drawable, GCPtr gc, RegionPtr region, box = REGION_RECTS(region); n = REGION_NUM_RECTS(region); do { + assert(box->x1 >= 0); + assert(box->y1 >= 0); + assert(box->x2 <= pixmap->drawable.width); + assert(box->y2 <= pixmap->drawable.height); + + assert(box->x1 - x >= 0); + assert(box->y1 - y >= 0); + assert(box->x2 - x <= w); + assert(box->y2 - y <= h); + memcpy_blt(bits, dst_bits, pixmap->drawable.bitsPerPixel, stride, dst_stride,