From dc6522dd491831f3843606e3ed57cc01fe2c804c Mon Sep 17 00:00:00 2001
From: Chris Wilson <chris@chris-wilson.co.uk>
Date: Sun, 24 Jan 2010 09:37:23 +0000
Subject: [PATCH] uxa: Protect against a potential NULL src->Drawable reference

One of the convoluted if branches dereferenced Drawable when it is
potentially NULL. Avoid this by explicitly handling the NULL Drawable
cases earlier, and enabling solid fills for solid sources.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
---
 uxa/uxa-render.c | 119 +++++++++++++++++++++++++++++++----------------
 1 file changed, 78 insertions(+), 41 deletions(-)

diff --git a/uxa/uxa-render.c b/uxa/uxa-render.c
index 9ccc7558..bffe64f7 100644
--- a/uxa/uxa-render.c
+++ b/uxa/uxa-render.c
@@ -271,16 +271,19 @@ uxa_try_driver_solid_fill(PicturePtr pSrc,
 	BoxPtr pbox;
 	int nbox;
 	int dst_off_x, dst_off_y;
-	PixmapPtr pSrcPix, pDstPix;
+	PixmapPtr pSrcPix = NULL, pDstPix;
 	CARD32 pixel;
 
 	pDstPix = uxa_get_drawable_pixmap(pDst->pDrawable);
-	pSrcPix = uxa_get_drawable_pixmap(pSrc->pDrawable);
 
 	xDst += pDst->pDrawable->x;
 	yDst += pDst->pDrawable->y;
-	xSrc += pSrc->pDrawable->x;
-	ySrc += pSrc->pDrawable->y;
+
+	if (pSrc->pDrawable) {
+		pSrcPix = uxa_get_drawable_pixmap(pSrc->pDrawable);
+		xSrc += pSrc->pDrawable->x;
+		ySrc += pSrc->pDrawable->y;
+	}
 
 	if (!miComputeCompositeRegion(&region, pSrc, NULL, pDst,
 				      xSrc, ySrc, 0, 0, xDst, yDst,
@@ -297,9 +300,21 @@ uxa_try_driver_solid_fill(PicturePtr pSrc,
 		return 0;
 	}
 
-	if (! uxa_get_color_for_pixmap (pSrcPix, pSrc->format, pDst->format, &pixel)) {
-		REGION_UNINIT(pDst->pDrawable->pScreen, &region);
-		return -1;
+	if (pSrcPix) {
+		if (! uxa_get_color_for_pixmap (pSrcPix, pSrc->format, pDst->format, &pixel)) {
+			REGION_UNINIT(pDst->pDrawable->pScreen, &region);
+			return -1;
+		}
+	} else {
+		SourcePict *source = pSrc->pSourcePict;
+		PictSolidFill *solid = &source->solidFill;
+
+		if (source == NULL || source->type != SourcePictTypeSolidFill) {
+			REGION_UNINIT(pDst->pDrawable->pScreen, &region);
+			return -1;
+		}
+
+		pixel = solid->color;
 	}
 
 	if (!(*uxa_screen->info->prepare_solid)
@@ -949,6 +964,32 @@ uxa_try_magic_two_pass_composite_helper(CARD8 op,
 	return 1;
 }
 
+static int
+compatible_formats (CARD8 op, PicturePtr dst, PicturePtr src)
+{
+	if (op == PictOpSrc) {
+		if (src->format == dst->format)
+			return 1;
+
+		if (src->format == PICT_a8r8g8b8 && dst->format == PICT_x8r8g8b8)
+			return 1;
+
+		if (src->format == PICT_a8b8g8r8 && dst->format == PICT_x8b8g8r8)
+			return 1;
+	} else if (op == PictOpOver) {
+		if (src->alphaMap || dst->alphaMap)
+			return 0;
+
+		if (src->format == dst->format)
+			return 1;
+
+		if (src->format == PICT_x8r8g8b8 || src->format == PICT_x8b8g8r8)
+			return 1;
+	}
+
+	return 0;
+}
+
 void
 uxa_composite(CARD8 op,
 	      PicturePtr pSrc,
@@ -976,27 +1017,29 @@ uxa_composite(CARD8 op,
 		pSrc->repeat = 0;
 
 	if (!pMask) {
-		if ((op == PictOpSrc &&
-		     ((pSrc->format == pDst->format) ||
-		      (pSrc->format == PICT_a8r8g8b8
-		       && pDst->format == PICT_x8r8g8b8)
-		      || (pSrc->format == PICT_a8b8g8r8
-			  && pDst->format == PICT_x8b8g8r8)))
-		    || (op == PictOpOver && !pSrc->alphaMap && !pDst->alphaMap
-			&& pSrc->format == pDst->format
-			&& (pSrc->format == PICT_x8r8g8b8
-			    || pSrc->format == PICT_x8b8g8r8))) {
+		if (pSrc->pDrawable == NULL) {
+			if (pSrc->pSourcePict) {
+				SourcePict *source = pSrc->pSourcePict;
+				if (source->type == SourcePictTypeSolidFill) {
+					ret = uxa_try_driver_solid_fill(pSrc, pDst,
+									xSrc, ySrc,
+									xDst, yDst,
+									width, height);
+					if (ret == 1)
+						goto done;
+				}
+			}
+		} else if (compatible_formats (op, pDst, pSrc)) {
 			if (pSrc->pDrawable->width == 1 &&
 			    pSrc->pDrawable->height == 1 &&
 			    pSrc->repeat) {
-				ret =
-				    uxa_try_driver_solid_fill(pSrc, pDst, xSrc,
-							      ySrc, xDst, yDst,
-							      width, height);
+				ret = uxa_try_driver_solid_fill(pSrc, pDst,
+								xSrc, ySrc,
+								xDst, yDst,
+								width, height);
 				if (ret == 1)
 					goto done;
-			} else if (pSrc->pDrawable != NULL &&
-				   !pSrc->repeat && !pSrc->transform) {
+			} else if (!pSrc->repeat && !pSrc->transform) {
 				xDst += pDst->pDrawable->x;
 				yDst += pDst->pDrawable->y;
 				xSrc += pSrc->pDrawable->x;
@@ -1016,8 +1059,7 @@ uxa_composite(CARD8 op,
 				REGION_UNINIT(pDst->pDrawable->pScreen,
 					      &region);
 				goto done;
-			} else if (pSrc->pDrawable != NULL &&
-				   pSrc->pDrawable->type == DRAWABLE_PIXMAP &&
+			} else if (pSrc->pDrawable->type == DRAWABLE_PIXMAP &&
 				   !pSrc->transform &&
 				   pSrc->repeatType == RepeatNormal) {
 				DDXPointRec patOrg;
@@ -1027,16 +1069,12 @@ uxa_composite(CARD8 op,
 				 */
 				if (uxa_screen->info->prepare_composite
 				    && !pSrc->alphaMap && !pDst->alphaMap) {
-					ret =
-					    uxa_try_driver_composite(op, pSrc,
-								     pMask,
-								     pDst, xSrc,
-								     ySrc,
-								     xMask,
-								     yMask,
-								     xDst, yDst,
-								     width,
-								     height);
+					ret = uxa_try_driver_composite(op, pSrc,
+								       pMask, pDst,
+								       xSrc, ySrc,
+								       xMask, yMask,
+								       xDst, yDst,
+								       width, height);
 					if (ret == 1)
 						goto done;
 				}
@@ -1060,12 +1098,11 @@ uxa_composite(CARD8 op,
 				patOrg.x = xDst - xSrc;
 				patOrg.y = yDst - ySrc;
 
-				ret =
-				    uxa_fill_region_tiled(pDst->pDrawable,
-							  &region,
-							  (PixmapPtr) pSrc->
-							  pDrawable, &patOrg,
-							  FB_ALLONES, GXcopy);
+				ret = uxa_fill_region_tiled(pDst->pDrawable,
+							    &region,
+							    (PixmapPtr) pSrc->
+							    pDrawable, &patOrg,
+							    FB_ALLONES, GXcopy);
 
 				REGION_UNINIT(pDst->pDrawable->pScreen,
 					      &region);