[Intel-gfx] [PATCH 20/22] Fix segv for clipped movie window

[Daniel Vetter]

From: Barry Scott <barry.scott at onelan.co.uk>

When playing a movie that is clipped on its left and right edges the
Xorg server will SEGV
sometimes. This is because the intel driver ignores the clipping info
when it copies
the planes out of the XV data.

The check for the optimised copy was wrong to ignore the width required.
Which leads
to too much data being copied by the memcpy. It the source buffer
happens to end
exactly on a page boundary the server will SEGV.

As we reviewed the code we checked the calculation of src1, src2 and
src3. The
patch includes additional comments to make it clear what the elements of the
calculation are.

This bug exists in git head and we also see it in 2.4.1.
---
 src/i830_video.c |   16 ++++++++++++----
 1 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/i830_video.c b/src/i830_video.c
index 29e03e1..00a1fcd 100644
--- a/src/i830_video.c
+++ b/src/i830_video.c
@@ -1373,7 +1373,8 @@ static void i830_memcpy_plane(unsigned char *dst, unsigned char *src,
 
     switch (rotation) {
     case RR_Rotate_0:
-	if (srcPitch == dstPitch)
+	/* optimise for the case of no clipping */
+	if (srcPitch == dstPitch && srcPitch == width)
 	    memcpy (dst, src, srcPitch * height);
 	else
 	    for (i = 0; i < height; i++) {
@@ -1443,7 +1444,11 @@ I830CopyPlanarData(I830PortPrivPtr pPriv,
     i830_memcpy_plane(dst1, src1, h, w, dstPitch2, srcPitch, pPriv->rotation);
 
     /* Copy V data for YV12, or U data for I420 */
-    src2 = buf + (srcH * srcPitch) + ((top * srcPitch) >> 2) + (left >> 1);
+    src2 = buf +                            /* start of YUV data */ 
+                (srcH * srcPitch) +         /* move over Luma plane */
+                ((top * srcPitch) >> 2) +   /* move down from by top lines */
+                    (left >> 1);            /* move left by left pixels */
+
 #if 0
     ErrorF("src2 is %p, offset is %ld\n", src2,
 	   (unsigned long)src2 - (unsigned long)buf);
@@ -1457,8 +1462,11 @@ I830CopyPlanarData(I830PortPrivPtr pPriv,
 		    dstPitch, srcPitch2, pPriv->rotation);
 
     /* Copy U data for YV12, or V data for I420 */
-    src3 = buf + (srcH * srcPitch) + ((srcH >> 1) * srcPitch2) +
-    ((top * srcPitch) >> 2) + (left >> 1);
+    src3 = buf +                            /* start of YUV data */ 
+                (srcH * srcPitch) +         /* move over Luma plane */
+                ((srcH >> 1) * srcPitch2) + /* move over Chroma plane */
+                ((top * srcPitch) >> 2) +   /* move down from by top lines */
+                    (left >> 1);            /* move left by left pixels */
 #if 0
     ErrorF("src3 is %p, offset is %ld\n", src3,
 	   (unsigned long)src3 - (unsigned long)buf);
-- 
1.6.3.3