andreacavalli/xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

glamor: Avoid overflow between box32 and box16 box

Browse Source 
glamor_compute_transform_clipped_regions() uses a temporary box32
internally which is copied back to a box16 to init the regions16,
thus causing a potential overflow.

If an overflow occurs, the given region is invalid and the pixmap
init region will fail.

Simply check that the coordinates won't overflow when copying back to
the box16, avoiding a crash later down the line in glamor.

Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=101894
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Tested-by: Fabrice Bellet <fabrice@bellet.info>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 9869dcb349)
This commit is contained in:
Olivier Fourdan 2017-07-26 16:00:38 +02:00 committed by Adam Jackson
parent 421814bc81
commit 69ab094a08
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
glamor/glamor_largepixmap.c
View File

@ -1,4 +1,5 @@
#include <stdlib.h>
#include <stdint.h> /* For INT16_MAX */
#include "glamor_priv.h"
@ -722,11 +723,11 @@ glamor_compute_transform_clipped_regions(PixmapPtr pixmap,
temp_box.x2 = MIN(temp_box.x2, pixmap->drawable.width);
temp_box.y2 = MIN(temp_box.y2, pixmap->drawable.height);
}
/* Now copy back the box32 to a box16 box. */
short_box.x1 = temp_box.x1;
short_box.y1 = temp_box.y1;
short_box.x2 = temp_box.x2;
short_box.y2 = temp_box.y2;
/* Now copy back the box32 to a box16 box, avoiding overflow. */
short_box.x1 = MIN(temp_box.x1, INT16_MAX);
short_box.y1 = MIN(temp_box.y1, INT16_MAX);
short_box.x2 = MIN(temp_box.x2, INT16_MAX);
short_box.y2 = MIN(temp_box.y2, INT16_MAX);
RegionInitBoxes(temp_region, &short_box, 1);
DEBUGF("copy to temp source region \n");
DEBUGRegionPrint(temp_region);