diff options
| author | Eric Anholt <eric@anholt.net> | 2013-12-23 01:26:56 -0800 |
|---|---|---|
| committer | Eric Anholt <eric@anholt.net> | 2014-01-09 15:23:23 +0800 |
| commit | 98cdb2ceede34ad04cd8f65691bd96fbb44bcced (patch) | |
| tree | 2de481cd1dc96dd9a1bd129d516cd6bc8ad44092 /src/mesa/drivers/dri/i965/intel_blit.c | |
| parent | bdc5241af4aa9afbd66f6c96ee6d20e09f77ea89 (diff) | |
| download | external_mesa3d-98cdb2ceede34ad04cd8f65691bd96fbb44bcced.zip external_mesa3d-98cdb2ceede34ad04cd8f65691bd96fbb44bcced.tar.gz external_mesa3d-98cdb2ceede34ad04cd8f65691bd96fbb44bcced.tar.bz2 | |
i965: Add a safety check for emitting blits.
With all of the flipping and pitch twiddling and miptree layout involved
in our blits, there are lots of ways for us to scribble outside of a
buffer. Put in a check that we're not about to do so.
This catches a bug that glamor was running into.
Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
Reviewed-by: Anuj Phogat <anuj.phogat@gmail.com>
Diffstat (limited to 'src/mesa/drivers/dri/i965/intel_blit.c')
| -rw-r--r-- | src/mesa/drivers/dri/i965/intel_blit.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/mesa/drivers/dri/i965/intel_blit.c b/src/mesa/drivers/dri/i965/intel_blit.c index 13cc777..9162b1f 100644 --- a/src/mesa/drivers/dri/i965/intel_blit.c +++ b/src/mesa/drivers/dri/i965/intel_blit.c @@ -391,6 +391,10 @@ intelEmitCopyBlit(struct brw_context *brw, assert(dst_x < dst_x2); assert(dst_y < dst_y2); + assert(src_offset + (src_y + h - 1) * abs(src_pitch) + + (w * cpp) <= src_buffer->size); + assert(dst_offset + (dst_y + h - 1) * abs(dst_pitch) + + (w * cpp) <= dst_buffer->size); BEGIN_BATCH_BLT_TILED(8, dst_y_tiled, src_y_tiled); |