Mesa (master): freedreno: reject imports with bogus pitch

[Rob Clark]

Module: Mesa
Branch: master
Commit: 32c061b110f6c4b6d6c7b1278d4e308e296c3a2a
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=32c061b110f6c4b6d6c7b1278d4e308e296c3a2a

Author: Rob Clark <robdclark at gmail.com>
Date:   Sat Sep  3 12:57:50 2016 -0400

freedreno: reject imports with bogus pitch

Signed-off-by: Rob Clark <robdclark at gmail.com>

---

 src/gallium/drivers/freedreno/freedreno_resource.c | 7 +++++--
 src/gallium/drivers/freedreno/freedreno_screen.c   | 5 +----
 src/gallium/drivers/freedreno/freedreno_screen.h   | 3 +--
 3 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/src/gallium/drivers/freedreno/freedreno_resource.c b/src/gallium/drivers/freedreno/freedreno_resource.c
index 3cc6654..1874271 100644
--- a/src/gallium/drivers/freedreno/freedreno_resource.c
+++ b/src/gallium/drivers/freedreno/freedreno_resource.c
@@ -898,15 +898,18 @@ fd_resource_from_handle(struct pipe_screen *pscreen,
 
 	util_range_init(&rsc->valid_buffer_range);
 
-	rsc->bo = fd_screen_bo_from_handle(pscreen, handle, &slice->pitch);
+	rsc->bo = fd_screen_bo_from_handle(pscreen, handle);
 	if (!rsc->bo)
 		goto fail;
 
 	rsc->base.vtbl = &fd_resource_vtbl;
 	rsc->cpp = util_format_get_blocksize(tmpl->format);
-	slice->pitch /= rsc->cpp;
+	slice->pitch = handle->stride / rsc->cpp;
 	slice->offset = handle->offset;
 
+	if ((slice->pitch < align(prsc->width0, 32)) || (slice->pitch % 32))
+		goto fail;
+
 	assert(rsc->cpp);
 
 	return prsc;
diff --git a/src/gallium/drivers/freedreno/freedreno_screen.c b/src/gallium/drivers/freedreno/freedreno_screen.c
index fbdd1e2..598a811 100644
--- a/src/gallium/drivers/freedreno/freedreno_screen.c
+++ b/src/gallium/drivers/freedreno/freedreno_screen.c
@@ -536,8 +536,7 @@ fd_screen_bo_get_handle(struct pipe_screen *pscreen,
 
 struct fd_bo *
 fd_screen_bo_from_handle(struct pipe_screen *pscreen,
-		struct winsys_handle *whandle,
-		unsigned *out_stride)
+		struct winsys_handle *whandle)
 {
 	struct fd_screen *screen = fd_screen(pscreen);
 	struct fd_bo *bo;
@@ -558,8 +557,6 @@ fd_screen_bo_from_handle(struct pipe_screen *pscreen,
 		return NULL;
 	}
 
-	*out_stride = whandle->stride;
-
 	return bo;
 }
 
diff --git a/src/gallium/drivers/freedreno/freedreno_screen.h b/src/gallium/drivers/freedreno/freedreno_screen.h
index c52c23b..03ee90a 100644
--- a/src/gallium/drivers/freedreno/freedreno_screen.h
+++ b/src/gallium/drivers/freedreno/freedreno_screen.h
@@ -86,8 +86,7 @@ boolean fd_screen_bo_get_handle(struct pipe_screen *pscreen,
 		unsigned stride,
 		struct winsys_handle *whandle);
 struct fd_bo * fd_screen_bo_from_handle(struct pipe_screen *pscreen,
-		struct winsys_handle *whandle,
-		unsigned *out_stride);
+		struct winsys_handle *whandle);
 
 struct pipe_screen * fd_screen_create(struct fd_device *dev);