Mesa (master): nv50,nvc0: guard against zero-size blits

[GitLab Mirror]

Module: Mesa
Branch: master
Commit: 9bf0614116cdfdbfca9952c6547331731a462dcc
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=9bf0614116cdfdbfca9952c6547331731a462dcc

Author: Ilia Mirkin <imirkin at alum.mit.edu>
Date:   Sun Oct  7 17:43:57 2018 -0400

nv50,nvc0: guard against zero-size blits

The current state tracker can generate these sometimes. Fixing this is
more involved, and due to some integer math we can generate
divisions-by-zero.

Signed-off-by: Ilia Mirkin <imirkin at alum.mit.edu>
Reviewed-by: Karol Herbst <kherbst at redhat.com>
Cc: mesa-stable at lists.freedesktop.org

---

 src/gallium/drivers/nouveau/nv50/nv50_surface.c | 7 +++++++
 src/gallium/drivers/nouveau/nvc0/nvc0_surface.c | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/src/gallium/drivers/nouveau/nv50/nv50_surface.c b/src/gallium/drivers/nouveau/nv50/nv50_surface.c
index 1ef0f5030a..de840eb531 100644
--- a/src/gallium/drivers/nouveau/nv50/nv50_surface.c
+++ b/src/gallium/drivers/nouveau/nv50/nv50_surface.c
@@ -1669,6 +1669,13 @@ nv50_blit(struct pipe_context *pipe, const struct pipe_blit_info *info)
    struct nouveau_pushbuf *push = nv50->base.pushbuf;
    bool eng3d = FALSE;
 
+   if (info->src.box.width == 0 || info->src.box.height == 0 ||
+       info->dst.box.width == 0 || info->dst.box.height == 0) {
+      pipe_debug_message(&nv50->base.debug, ERROR,
+                         "Blit with zero-size src or dst box");
+      return;
+   }
+
    if (util_format_is_depth_or_stencil(info->dst.resource->format)) {
       if (!(info->mask & PIPE_MASK_ZS))
          return;
diff --git a/src/gallium/drivers/nouveau/nvc0/nvc0_surface.c b/src/gallium/drivers/nouveau/nvc0/nvc0_surface.c
index 39b1369758..120f9fe6ab 100644
--- a/src/gallium/drivers/nouveau/nvc0/nvc0_surface.c
+++ b/src/gallium/drivers/nouveau/nvc0/nvc0_surface.c
@@ -1573,6 +1573,13 @@ nvc0_blit(struct pipe_context *pipe, const struct pipe_blit_info *info)
    struct nouveau_pushbuf *push = nvc0->base.pushbuf;
    bool eng3d = false;
 
+   if (info->src.box.width == 0 || info->src.box.height == 0 ||
+       info->dst.box.width == 0 || info->dst.box.height == 0) {
+      pipe_debug_message(&nvc0->base.debug, ERROR,
+                         "Blit with zero-size src or dst box");
+      return;
+   }
+
    if (util_format_is_depth_or_stencil(info->dst.resource->format)) {
       if (!(info->mask & PIPE_MASK_ZS))
          return;