[Bug 91065] Invalid read in intel_tiled_memcpy.c ytiled_to_linear

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=91065

--- Comment #4 from Jun Wu <arcppzju+fdbug at gmail.com> ---
It seems the quick workaround is like:

--- a/src/mesa/drivers/dri/i965/intel_pixel_read.c
+++ b/src/mesa/drivers/dri/i965/intel_pixel_read.c
@@ -185,6 +185,14 @@ intel_readpixels_tiled_memcpy(struct gl_context * ctx,
       dst_pitch = -dst_pitch;
    }

+   /* For I915_TILING_Y, if src does not have enough pixels, decrease height
+    * silently to prevent invalid memory access.
+    */
+   uint32_t tiling = irb->mt->tiling;
+   if (tiling == I915_TILING_Y && bo->size < height * dst_pitch) {
+      height = bo->size / dst_pitch;
+   }
+
    /* We postponed printing this message until having committed to executing
     * the function.
     */
@@ -203,7 +211,7 @@ intel_readpixels_tiled_memcpy(struct gl_context * ctx,
       bo->virtual,
       dst_pitch, irb->mt->pitch,
       brw->has_swizzling,
-      irb->mt->tiling,
+      tiling,
       mem_copy
    );

However I am not sure about whether it is a correct fix or not.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/intel-3d-bugs/attachments/20150623/3ed618ca/attachment.html>