fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2026-05-05 18:08:08 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Added checks to avoid writing past the end of the buffer in fbBltOne

Browse source
This commit is contained in:
Ben Byer 2007-12-07 21:56:45 -08:00
parent d12b650362
commit e5f54f122b
1 changed files with 26 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
fb/fbbltone.c
View file

@ -58,6 +58,13 @@
} else \
bits = (src < srcEnd ? *src++ : 0); \
}
#define CHECK_BOUNDS(pointer, limit) \
if (dst > dstEnd) { \
ErrorF("WARNING: fbbltone tried to write over end of buffer (dst=%p dstEnd=%p)\n", \
dst, dstEnd); \
return; \
}
#ifndef FBNOPIXADDR
@ -150,7 +157,7 @@ fbBltOne (FbStip *src,
FbBits bgxor)
{
const FbBits *fbBits;
FbBits *srcEnd;
FbBits *srcEnd, *dstEnd;
int pixelsPerDst; /* dst pixels per FbBits */
int unitsPerSrc; /* src patterns per FbStip */
int leftShift, rightShift; /* align source with dest */
@ -183,9 +190,10 @@ fbBltOne (FbStip *src,
#endif
/*
* Do not read past the end of the buffer!
* Do not read or write past the end of the buffer!
*/
srcEnd = src + height * srcStride;
dstEnd = dst + height * dstStride;
/*
* Number of destination units in FbBits == number of stipple pixels
@ -298,6 +306,7 @@ fbBltOne (FbStip *src,
*/
if (startmask)
{
CHECK_BOUNDS(dst, dstEnd);
#if FB_UNIT > 32
if (pixelsPerDst == 16)
mask = FbStipple16Bits(FbLeftStipBits(bits,16));
@ -338,6 +347,7 @@ fbBltOne (FbStip *src,
else
#endif
mask = fbBits[FbLeftStipBits(bits,pixelsPerDst)];
CHECK_BOUNDS(dst, dstEnd);
*dst = FbOpaqueStipple (mask, fgxor, bgxor);
dst++;
bits = FbStipLeft(bits, pixelsPerDst);
@ -348,6 +358,7 @@ fbBltOne (FbStip *src,
#ifndef FBNOPIXADDR
if (fbLane)
{
CHECK_BOUNDS(dst, dstEnd);
while (bits && n)
{
switch (fbLane[FbLeftStipBits(bits,pixelsPerDst)]) {
@ -368,6 +379,7 @@ fbBltOne (FbStip *src,
if (left || !transparent)
{
mask = fbBits[left];
CHECK_BOUNDS(dst, dstEnd);
*dst = FbStippleRRop (*dst, mask,
fgand, fgxor, bgand, bgxor);
}
@ -588,7 +600,7 @@ fbBltOne24 (FbStip *srcLine,
FbBits bgand,
FbBits bgxor)
{
FbStip *src, *srcEnd;
FbStip *src, *srcEnd, *dstEnd;
FbBits leftMask, rightMask, mask;
int nlMiddle, nl;
FbStip stip, bits;
@ -599,9 +611,10 @@ fbBltOne24 (FbStip *srcLine,
int nDst;
/*
* Do not read past the end of the buffer!
* Do not read or write past the end of the buffer!
*/
srcEnd = srcLine + height * srcStride;
dstEnd = dst + height * dstStride;
srcLine += srcX >> FB_STIP_SHIFT;
dst += dstX >> FB_SHIFT;
@ -631,6 +644,7 @@ fbBltOne24 (FbStip *srcLine,
if (leftMask)
{
mask = fbStipple24Bits[rot >> 3][stip];
CHECK_BOUNDS(dst, dstEnd);
*dst = (*dst & ~leftMask) | (FbOpaqueStipple (mask,
FbRot24(fgxor, rot),
FbRot24(bgxor, rot))
@ -642,6 +656,7 @@ fbBltOne24 (FbStip *srcLine,
while (nl--)
{
mask = fbStipple24Bits[rot>>3][stip];
CHECK_BOUNDS(dst, dstEnd);
*dst = FbOpaqueStipple (mask,
FbRot24(fgxor, rot),
FbRot24(bgxor, rot));
@ -651,6 +666,7 @@ fbBltOne24 (FbStip *srcLine,
if (rightMask)
{
mask = fbStipple24Bits[rot >> 3][stip];
CHECK_BOUNDS(dst, dstEnd);
*dst = (*dst & ~rightMask) | (FbOpaqueStipple (mask,
FbRot24(fgxor, rot),
FbRot24(bgxor, rot))
@ -674,6 +690,7 @@ fbBltOne24 (FbStip *srcLine,
if (stip)
{
mask = fbStipple24Bits[rot >> 3][stip] & leftMask;
CHECK_BOUNDS(dst, dstEnd);
*dst = (*dst & ~mask) | (FbRot24(fgxor, rot) & mask);
}
dst++;
@ -685,6 +702,7 @@ fbBltOne24 (FbStip *srcLine,
if (stip)
{
mask = fbStipple24Bits[rot>>3][stip];
CHECK_BOUNDS(dst, dstEnd);
*dst = (*dst & ~mask) | (FbRot24(fgxor,rot) & mask);
}
dst++;
@ -695,6 +713,7 @@ fbBltOne24 (FbStip *srcLine,
if (stip)
{
mask = fbStipple24Bits[rot >> 3][stip] & rightMask;
CHECK_BOUNDS(dst, dstEnd);
*dst = (*dst & ~mask) | (FbRot24(fgxor, rot) & mask);
}
}
@ -712,6 +731,7 @@ fbBltOne24 (FbStip *srcLine,
if (leftMask)
{
mask = fbStipple24Bits[rot >> 3][stip];
CHECK_BOUNDS(dst, dstEnd);
*dst = FbStippleRRopMask (*dst, mask,
FbRot24(fgand, rot),
FbRot24(fgxor, rot),
@ -725,6 +745,7 @@ fbBltOne24 (FbStip *srcLine,
while (nl--)
{
mask = fbStipple24Bits[rot >> 3][stip];
CHECK_BOUNDS(dst, dstEnd);
*dst = FbStippleRRop (*dst, mask,
FbRot24(fgand, rot),
FbRot24(fgxor, rot),
@ -736,6 +757,7 @@ fbBltOne24 (FbStip *srcLine,
if (rightMask)
{
mask = fbStipple24Bits[rot >> 3][stip];
CHECK_BOUNDS(dst, dstEnd);
*dst = FbStippleRRopMask (*dst, mask,
FbRot24(fgand, rot),
FbRot24(fgxor, rot),