andreacavalli/xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Added checks to avoid writing past the end of the buffer in fbBltOne

Browse Source 
(cherry picked from commit e5f54f122b)
This commit is contained in:
Ben Byer 2007-12-07 21:56:45 -08:00 committed by Jeremy Huddleston
parent c8161d482a
commit 24c54f53ff
1 changed files with 27 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
fb/fbbltone.c
View File

@ -56,6 +56,13 @@
} else \
bits = (src < srcEnd ? READ(src++) : 0); \
}
#define CHECK_BOUNDS(pointer, limit) \
if (dst > dstEnd) { \
ErrorF("WARNING: fbbltone tried to write over end of buffer (dst=%p dstEnd=%p)\n", \
dst, dstEnd); \
return; \
}
#ifndef FBNOPIXADDR
@ -148,7 +155,7 @@ fbBltOne (FbStip *src,
FbBits bgxor)
{
const FbBits *fbBits;
FbBits *srcEnd;
FbBits *srcEnd, *dstEnd;
int pixelsPerDst; /* dst pixels per FbBits */
int unitsPerSrc; /* src patterns per FbStip */
int leftShift, rightShift; /* align source with dest */
@ -181,9 +188,10 @@ fbBltOne (FbStip *src,
#endif
/*
* Do not read past the end of the buffer!
* Do not read or write past the end of the buffer!
*/
srcEnd = src + height * srcStride;
dstEnd = dst + height * dstStride;
/*
* Number of destination units in FbBits == number of stipple pixels
@ -296,6 +304,7 @@ fbBltOne (FbStip *src,
*/
if (startmask)
{
CHECK_BOUNDS(dst, dstEnd);
#if FB_UNIT > 32
if (pixelsPerDst == 16)
mask = FbStipple16Bits(FbLeftStipBits(bits,16));
@ -336,6 +345,7 @@ fbBltOne (FbStip *src,
else
#endif
mask = fbBits[FbLeftStipBits(bits,pixelsPerDst)];
CHECK_BOUNDS(dst, dstEnd);
WRITE(dst, FbOpaqueStipple (mask, fgxor, bgxor));
dst++;
bits = FbStipLeft(bits, pixelsPerDst);
@ -346,6 +356,7 @@ fbBltOne (FbStip *src,
#ifndef FBNOPIXADDR
if (fbLane)
{
CHECK_BOUNDS(dst, dstEnd);
while (bits && n)
{
switch (fbLane[FbLeftStipBits(bits,pixelsPerDst)]) {
@ -366,6 +377,7 @@ fbBltOne (FbStip *src,
if (left || !transparent)
{
mask = fbBits[left];
CHECK_BOUNDS(dst, dstEnd);
WRITE(dst, FbStippleRRop (READ(dst), mask,
fgand, fgxor, bgand, bgxor));
}
@ -586,7 +598,7 @@ fbBltOne24 (FbStip *srcLine,
FbBits bgand,
FbBits bgxor)
{
FbStip *src, *srcEnd;
FbStip *src, *srcEnd, *dstEnd;
FbBits leftMask, rightMask, mask;
int nlMiddle, nl;
FbStip stip, bits;
@ -597,9 +609,10 @@ fbBltOne24 (FbStip *srcLine,
int nDst;
/*
* Do not read past the end of the buffer!
* Do not read or write past the end of the buffer!
*/
srcEnd = srcLine + height * srcStride;
dstEnd = dst + height * dstStride;
srcLine += srcX >> FB_STIP_SHIFT;
dst += dstX >> FB_SHIFT;
@ -629,6 +642,7 @@ fbBltOne24 (FbStip *srcLine,
if (leftMask)
{
mask = fbStipple24Bits[rot >> 3][stip];
CHECK_BOUNDS(dst, dstEnd);
WRITE(dst, (READ(dst) & ~leftMask) |
(FbOpaqueStipple (mask,
FbRot24(fgxor, rot),
@ -641,6 +655,7 @@ fbBltOne24 (FbStip *srcLine,
while (nl--)
{
mask = fbStipple24Bits[rot>>3][stip];
CHECK_BOUNDS(dst, dstEnd);
WRITE(dst, FbOpaqueStipple (mask,
FbRot24(fgxor, rot),
FbRot24(bgxor, rot)));
@ -650,6 +665,7 @@ fbBltOne24 (FbStip *srcLine,
if (rightMask)
{
mask = fbStipple24Bits[rot >> 3][stip];
CHECK_BOUNDS(dst, dstEnd);
WRITE(dst, (READ(dst) & ~rightMask) |
(FbOpaqueStipple (mask,
FbRot24(fgxor, rot),
@ -674,7 +690,8 @@ fbBltOne24 (FbStip *srcLine,
if (stip)
{
mask = fbStipple24Bits[rot >> 3][stip] & leftMask;
WRITE(dst, (READ(dst) & ~mask) | (FbRot24(fgxor, rot) & mask));
CHECK_BOUNDS(dst, dstEnd);
WRITE(dst, (READ(dst) & ~mask) | (FbRot24(fgxor, rot) & mask));
}
dst++;
fbNextStipBits (rot, stip);
@ -685,6 +702,7 @@ fbBltOne24 (FbStip *srcLine,
if (stip)
{
mask = fbStipple24Bits[rot>>3][stip];
CHECK_BOUNDS(dst, dstEnd);
WRITE(dst, (READ(dst) & ~mask) | (FbRot24(fgxor,rot) & mask));
}
dst++;
@ -695,6 +713,7 @@ fbBltOne24 (FbStip *srcLine,
if (stip)
{
mask = fbStipple24Bits[rot >> 3][stip] & rightMask;
CHECK_BOUNDS(dst, dstEnd);
WRITE(dst, (READ(dst) & ~mask) | (FbRot24(fgxor, rot) & mask));
}
}
@ -712,6 +731,7 @@ fbBltOne24 (FbStip *srcLine,
if (leftMask)
{
mask = fbStipple24Bits[rot >> 3][stip];
CHECK_BOUNDS(dst, dstEnd);
WRITE(dst, FbStippleRRopMask (READ(dst), mask,
FbRot24(fgand, rot),
FbRot24(fgxor, rot),
@ -725,6 +745,7 @@ fbBltOne24 (FbStip *srcLine,
while (nl--)
{
mask = fbStipple24Bits[rot >> 3][stip];
CHECK_BOUNDS(dst, dstEnd);
WRITE(dst, FbStippleRRop (READ(dst), mask,
FbRot24(fgand, rot),
FbRot24(fgxor, rot),
@ -736,6 +757,7 @@ fbBltOne24 (FbStip *srcLine,
if (rightMask)
{
mask = fbStipple24Bits[rot >> 3][stip];
CHECK_BOUNDS(dst, dstEnd);
WRITE(dst, FbStippleRRopMask (READ(dst), mask,
FbRot24(fgand, rot),
FbRot24(fgxor, rot),