[Intel-gfx] [PATCH] Xv overlay: fix planar YUV copy for right rotated crtcs

[Daniel Vetter]

While copying and rotating the buffer, array access was out of bounds when
rotated to the right (RR_Rotate_270).  My buffer handling changes probably
made this bug much more likely to actually result in a SIGSEGV.

I've checked the logs and the bug exists since rotation has been supported,
i.e.  this looks like a candidate for cherry-picking for all supported
releases.

Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
---
 src/i830_video.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/i830_video.c b/src/i830_video.c
index aaaf78f..e376385 100644
--- a/src/i830_video.c
+++ b/src/i830_video.c
@@ -888,13 +888,13 @@ I830CopyPackedData(intel_adaptor_private *adaptor_priv,
 				dst[(((h - i) * 2) - 3) + (j * dstPitch)] =
 				    src[(j * 2) + 1 + (i * srcPitch)];
 				dst[(((h - i) * 2) - 3) +
-				    ((j - 1) * dstPitch)] =
+				    ((j + 1) * dstPitch)] =
 				    src[(j * 2) + 1 + ((i + 1) * srcPitch)];
 				/* Copy V */
 				dst[(((h - i) * 2) - 1) + (j * dstPitch)] =
 				    src[(j * 2) + 3 + (i * srcPitch)];
 				dst[(((h - i) * 2) - 1) +
-				    ((j - 1) * dstPitch)] =
+				    ((j + 1) * dstPitch)] =
 				    src[(j * 2) + 3 + ((i + 1) * srcPitch)];
 			}
 		}
-- 
1.6.4.3