<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - X server crash in nouveau_xv.c:NVPutImage (NVCopyNV12ColorPlanes)"
href="https://bugs.freedesktop.org/show_bug.cgi?id=63263#c2">Comment # 2</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW --- - X server crash in nouveau_xv.c:NVPutImage (NVCopyNV12ColorPlanes)"
href="https://bugs.freedesktop.org/show_bug.cgi?id=63263">bug 63263</a>
from <span class="vcard"><a class="email" href="mailto:imirkin@alum.mit.edu" title="Ilia Mirkin <imirkin@alum.mit.edu>"> <span class="fn">Ilia Mirkin</span></a>
</span></b>
<pre>A little more info:
I added code to call NVQueryImageAttributes inside of NVPutImage, compute an
end pointer (buf + size), and then check inside of NVCopyNV12ColorPlanes at the
end of every loop iteration whether either us or vs have gone off the end.
And it seems like they do! When I move the mplayer window s.t. part of it is
off-screen (on the left), the code ends up accessing 2 bytes further than the
end of the array! There happens to be another mapping afterwards which means
that there's no segfault, but if that mapping isn't there, a segfault would
have occurred.
Now, it only ever goes over by 1-3 bytes, never more. One thing that I noticed
is that we pass in line_len to NVCopyNV12ColorPlanes as the width (which is
rounded up to 8 on NV_50 and up) rather than npixels (which is rounded up to
4). I also wonder if there's some issue in how left is computed (and then
applied to the s2/3 offsets)...</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>