Aurelien
/
xf86-video-intel
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sna/dri: Apply the can_blit() check for CopyRegion 

CopyRegion() also needs to check for stale bo in case the pixmap
dimensions have changed size and so may cause out-of-bounds read/writes.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
This commit is contained in:
Chris Wilson 2012-11-12 14:45:56 +00:00
parent b27ecf3059
commit 66eb0adffa
1 changed files with 19 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
src/sna/sna_dri.c
View File

@ -808,6 +808,22 @@ sna_dri_copy(struct sna *sna, DrawablePtr draw, RegionPtr region,
pixman_region_fini(&clip);
}
static bool
can_blit(struct sna * sna,
DrawablePtr draw,
DRI2BufferPtr front,
DRI2BufferPtr back)
{
PixmapPtr pixmap;
if (draw->type == DRAWABLE_PIXMAP)
return true;
pixmap = get_drawable_pixmap(draw);
return (get_private(front)->serial == pixmap->drawable.serialNumber &&
get_private(back)->serial == pixmap->drawable.serialNumber);
}
static void
sna_dri_copy_region(DrawablePtr draw,
RegionPtr region,
@ -820,6 +836,9 @@ sna_dri_copy_region(DrawablePtr draw,
void (*copy)(struct sna *, DrawablePtr, RegionPtr,
struct kgem_bo *, struct kgem_bo *, bool) = sna_dri_copy;
if (!can_blit(sna, draw, dst_buffer, src_buffer))
return;
if (dst_buffer->attachment == DRI2BufferFrontLeft) {
dst = sna_pixmap_get_bo(pixmap);
copy = (void *)sna_dri_copy_to_front;
@ -1179,22 +1198,6 @@ can_exchange(struct sna * sna,
return true;
}
static bool
can_blit(struct sna * sna,
DrawablePtr draw,
DRI2BufferPtr front,
DRI2BufferPtr back)
{
PixmapPtr pixmap;
if (draw->type == DRAWABLE_PIXMAP)
return true;
pixmap = get_drawable_pixmap(draw);
return (get_private(front)->serial == pixmap->drawable.serialNumber &&
get_private(back)->serial == pixmap->drawable.serialNumber);
}
inline static uint32_t pipe_select(int pipe)
{
/* The third pipe was introduced with IvyBridge long after