From aaedeffe00d9414bb03723dbc30b4938a07ce5fa Mon Sep 17 00:00:00 2001 From: Daniel Vetter Date: Wed, 14 Oct 2009 18:09:08 +0200 Subject: [PATCH] Xv overlay: fix planar YUV copy for right rotated crtcs While copying and rotating the buffer, array access was out of bounds when rotated to the right (RR_Rotate_270). My buffer handling changes probably made this bug much more likely to actually result in a SIGSEGV. I've checked the logs and the bug exists since rotation has been supported, i.e. this looks like a candidate for cherry-picking for all supported releases. Signed-off-by: Daniel Vetter Signed-off-by: Eric Anholt --- src/i830_video.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/i830_video.c b/src/i830_video.c index 191f44e2..848099d1 100644 --- a/src/i830_video.c +++ b/src/i830_video.c @@ -887,13 +887,13 @@ I830CopyPackedData(intel_adaptor_private *adaptor_priv, dst[(((h - i) * 2) - 3) + (j * dstPitch)] = src[(j * 2) + 1 + (i * srcPitch)]; dst[(((h - i) * 2) - 3) + - ((j - 1) * dstPitch)] = + ((j + 1) * dstPitch)] = src[(j * 2) + 1 + ((i + 1) * srcPitch)]; /* Copy V */ dst[(((h - i) * 2) - 1) + (j * dstPitch)] = src[(j * 2) + 3 + (i * srcPitch)]; dst[(((h - i) * 2) - 1) + - ((j - 1) * dstPitch)] = + ((j + 1) * dstPitch)] = src[(j * 2) + 3 + ((i + 1) * srcPitch)]; } }