From e67eb051d41d64bc4fb8d81893074b7a158d6c0f Mon Sep 17 00:00:00 2001
From: Craig Stout <craig.stout@ti.com>
Date: Wed, 5 Sep 2012 14:41:04 -0700
Subject: gcbv-user: validate dest rect after clipping

According to bltsville spec, rectangles should not be checked
for validity until clipping has been applied.  So we must clip
the dest rect before validating it.  Removed the error checking
from the generic rect converter macro.  Added error checking
specifically for clip rect and dest rect, post clipping. Proper
validity checking of other rects is TBD.

Change-Id: I07022b5d112bf7b25f592e456429c1876c885fd1
Signed-off-by: Craig Stout <craig.stout@ti.com>
---
 gcbv/mirror/gcparser.c | 56 +++++++++++++++++++++++++++++++++++---------------
 1 file changed, 39 insertions(+), 17 deletions(-)

(limited to 'gcbv')

diff --git a/gcbv/mirror/gcparser.c b/gcbv/mirror/gcparser.c
index 18889ba..d41223d 100644
--- a/gcbv/mirror/gcparser.c
+++ b/gcbv/mirror/gcparser.c
@@ -54,22 +54,13 @@ GCDBG_FILTERDEF(gcparser, GCZONE_NONE,
  * Internal macros.
  */
 
-#define GCCONVERT_RECT(zone, error, name, bvrect, gcrect) \
+#define GCCONVERT_RECT(zone, name, bvrect, gcrect) \
 { \
 	(gcrect)->left = (bvrect)->left; \
 	(gcrect)->top = (bvrect)->top; \
 	(gcrect)->right = (bvrect)->left + (bvrect)->width; \
 	(gcrect)->bottom = (bvrect)->top + (bvrect)->height; \
 	\
-	if (((gcrect)->left   < GC_CLIP_RESET_LEFT)  || \
-	    ((gcrect)->top    < GC_CLIP_RESET_TOP)   || \
-	    ((gcrect)->right  > GC_CLIP_RESET_RIGHT) || \
-	    ((gcrect)->bottom > GC_CLIP_RESET_BOTTOM)) { \
-		BVSETBLTERROR((error), \
-			      "invalid " name " rectangle"); \
-		goto exit; \
-	} \
-	\
 	GCDBG(zone, \
 	      name " = (%d,%d)-(%d,%d), %dx%d\n", \
 	      (gcrect)->left, (gcrect)->top, \
@@ -1454,7 +1445,15 @@ enum bverror parse_destination(struct bvbltparams *bvbltparams,
 
 		/* Determine destination rectangle. */
 		dstrect = &dstinfo->rect;
-		GCCONVERT_RECT(GCZONE_DEST, BVERR_DSTRECT,
+
+		GCDBG(GCZONE_DEST,
+		      "destination = (%d,%d) %dx%d\n",
+		      bvbltparams->dstrect.left,
+		      bvbltparams->dstrect.top,
+		      bvbltparams->dstrect.width,
+		      bvbltparams->dstrect.height);
+
+		GCCONVERT_RECT(GCZONE_DEST,
 			       "destination",
 			       &bvbltparams->dstrect,
 			       dstrect);
@@ -1465,11 +1464,27 @@ enum bverror parse_destination(struct bvbltparams *bvbltparams,
 		/* Is clipping rectangle specified? */
 		if ((bvbltparams->flags & BVFLAG_CLIP) == BVFLAG_CLIP) {
 			/* Convert and validate clipping rectangle. */
-			GCCONVERT_RECT(GCZONE_DEST, BVERR_CLIP_RECT,
+			GCDBG(GCZONE_DEST,
+			      "clip = (%d,%d) %dx%d\n",
+			      bvbltparams->cliprect.left,
+			      bvbltparams->cliprect.top,
+			      bvbltparams->cliprect.width,
+			      bvbltparams->cliprect.height);
+
+			GCCONVERT_RECT(GCZONE_DEST,
 				       "clipping",
 				       &bvbltparams->cliprect,
 				       &cliprect);
 
+			if (cliprect.left < GC_CLIP_RESET_LEFT ||
+			    cliprect.top < GC_CLIP_RESET_TOP ||
+			    cliprect.right > GC_CLIP_RESET_RIGHT ||
+			    cliprect.bottom > GC_CLIP_RESET_BOTTOM) {
+				BVSETERROR(BVERR_CLIP_RECT,
+					   "clip rect is invalid");
+				goto exit;
+			}
+
 			/* Compute clipping deltas and the adjusted
 			 * destination rect. */
 			if (cliprect.left <= dstrect->left) {
@@ -1511,7 +1526,7 @@ enum bverror parse_destination(struct bvbltparams *bvbltparams,
 			/* Clip the aux destination. */
 			if (haveaux) {
 				/* Convert and validate aux rectangle. */
-				GCCONVERT_RECT(GCZONE_DEST, BVERR_DSTRECT,
+				GCCONVERT_RECT(GCZONE_DEST,
 					       "aux destination",
 					       &bvbltparams->src2auxdstrect,
 					       &dstrectaux);
@@ -1545,7 +1560,7 @@ enum bverror parse_destination(struct bvbltparams *bvbltparams,
 			batch->dstclipped = *dstrect;
 			if (haveaux)
 				/* Convert and validate aux rectangle. */
-				GCCONVERT_RECT(GCZONE_DEST, BVERR_DSTRECT,
+				GCCONVERT_RECT(GCZONE_DEST,
 					       "aux destination",
 					       &bvbltparams->src2auxdstrect,
 					       &batch->dstclippedaux);
@@ -1562,6 +1577,16 @@ enum bverror parse_destination(struct bvbltparams *bvbltparams,
 		      batch->dstclipped.bottom -
 		      batch->dstclipped.top);
 
+		/* Check for valid dest rect after clipping. */
+		if (batch->dstclipped.left < 0 ||
+		    batch->dstclipped.top < 0 ||
+		    batch->dstclipped.right > dstinfo->geom->width ||
+		    batch->dstclipped.bottom > dstinfo->geom->height) {
+			BVSETBLTERROR(BVERR_DSTRECT,
+				      "destination rect invalid");
+			goto exit;
+		}
+
 		if (haveaux)
 			GCDBG(GCZONE_DEST,
 			      "clipped aux dest = (%d,%d)-(%d,%d), %dx%d\n",
@@ -1598,9 +1623,6 @@ enum bverror parse_source(struct bvbltparams *bvbltparams,
 
 	/* Convert the rectangle. */
 	GCCONVERT_RECT(GCZONE_SRC,
-		       (srcinfo->index == 0)
-				? BVERR_SRC1GEOM_FORMAT
-				: BVERR_SRC2GEOM_FORMAT,
 		       "source", srcrect, &srcinfo->rect);
 
 	/* Parse the source format. */
-- 
cgit v1.1