fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-01-20 17:30:24 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

intel/blorp: Fix possible NULL pointer dereferencing

Browse source 
Fix incomplete check of input params in blorp_surf_convert_to_uncompressed()
which can lead to NULL pointer dereferencing.

Fixes: 5ae8043fed ("intel/blorp: Add an entrypoint for doing
bit-for-bit copies")
Fixes: f395d0abc8 ("intel/blorp: Internally expose
surf_convert_to_uncompressed")
Reviewed-by: Emil Velikov <emli.velikov@collabora.com>
Reviewed-by: Andres Gomez <agomez@igalia.com>

(cherry picked from commit cdb3eb7174)
This commit is contained in:
Vadym Shovkoplias 2017-11-27 12:15:13 +02:00 • committed by Emil Velikov
parent bcd4f26b41
commit 4e84aaa906
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/intel/blorp/blorp_blit.c
View file

@ -2344,7 +2344,7 @@ blorp_surf_convert_to_uncompressed(const struct isl_device *isl_dev,
*/
blorp_surf_convert_to_single_slice(isl_dev, info);
if (width || height) {
if (width && height) {
#ifndef NDEBUG
uint32_t right_edge_px = info->tile_x_sa + *x + *width;
uint32_t bottom_edge_px = info->tile_y_sa + *y + *height;
@ -2357,7 +2357,7 @@ blorp_surf_convert_to_uncompressed(const struct isl_device *isl_dev,
*height = DIV_ROUND_UP(*height, fmtl->bh);
}
if (x || y) {
if (x && y) {
assert(*x % fmtl->bw == 0);
assert(*y % fmtl->bh == 0);
*x /= fmtl->bw;