egl/dri2: Guard against invalid fourcc formats

We already reject attempts to import images with invalid fourcc formats
but don't really guard the queries all that well.  This makes us error
out in any calls to eglQueryDmaBufModifiersEXT if the given format is
not a valid fourcc format.  We also add an assert to ensure that drivers
don't advertise any non-fourcc formats.

Cc: mesa-stable@lists.freedesktop.org
Tested-By: Eero Tamminen <eero.t.tamminen@intel.com>
Reviewed-by: Eric Engestrom <eric.engestrom@intel.com>
(cherry picked from commit 8c1b9882b2)

Squashed with commit:

st/dri: Don't expose sRGB formats to clients

Though the SARGB8888 format is used internally through its FourCC value,
it is not a real format as defined by drm_fourcc.h; it cannot be used
with KMS or other interfaces expecting drm_fourcc.h format codes.

Ensure we don't advertise it through the dmabuf format/modifier query
interfaces, preventing us from tripping over an assert.

Signed-off-by: Daniel Stone <daniels@collabora.com>
Reported-by: Michel Dänzer <michel.daenzer@amd.com>
Fixes: 8c1b9882b2 ("egl/dri2: Guard against invalid fourcc formats")
Acked-by: Jason Ekstrand <jason.ekstrand@intel.com>
(cherry picked from commit 01c0aa9f05)

src/egl/drivers/dri2/egl_dri2.c

@@ -2353,6 +2353,18 @@ dri2_query_dma_buf_formats(_EGLDriver *drv, _EGLDisplay *disp,
                                             formats, count))
       return EGL_FALSE;
 
+   if (max > 0) {
+      /* Assert that all of the formats returned are actually fourcc formats.
+       * Some day, if we want the internal interface function to be able to
+       * return the fake fourcc formats defined in dri_interface.h, we'll have
+       * to do something more clever here to pair the list down to just real
+       * fourcc formats so that we don't leak the fake internal ones.
+       */
+      for (int i = 0; i < *count; i++) {
+         assert(dri2_num_fourcc_format_planes(formats[i]) > 0);
+      }
+   }
+
    return EGL_TRUE;
 }
 
@@ -2363,6 +2375,9 @@ dri2_query_dma_buf_modifiers(_EGLDriver *drv, _EGLDisplay *disp, EGLint format,
 {
    struct dri2_egl_display *dri2_dpy = dri2_egl_display(disp);
 
+   if (dri2_num_fourcc_format_planes(format) == 0)
+      return _eglError(EGL_BAD_PARAMETER, "invalid fourcc format");
+
    if (max < 0)
       return _eglError(EGL_BAD_PARAMETER, "invalid value for max count of formats");
 

src/gallium/state_trackers/dri/dri2.c

@@ -1485,6 +1485,12 @@ dri2_query_dma_buf_formats(__DRIscreen *_screen, int max, int *formats,
 
    for (i = 0, j = 0; (i < ARRAY_SIZE(fourcc_formats)) &&
          (j < max || max == 0); i++) {
+      /* The sRGB format is not a real FourCC as defined by drm_fourcc.h, so we
+       * must not leak it out to clients.
+       */
+      if (fourcc_formats[i] == __DRI_IMAGE_FOURCC_SARGB8888)
+         continue;
+
       if (pscreen->is_format_supported(pscreen,
                                        fourcc_to_pipe_format(
                                           fourcc_formats[i]),