[Mesa-dev] [RFC 4/7] xa: fix dma copy function

[Rob Clark]

From: Jerome Glisse <jglisse at redhat.com>

pipe_transfer_map already offset the surface properly so using the offset
again with util_copy_rect might lead to read/write outside the surface.

Signed-off-by: Jerome Glisse <jglisse at redhat.com>
---
 src/gallium/state_trackers/xa/xa_context.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/gallium/state_trackers/xa/xa_context.c b/src/gallium/state_trackers/xa/xa_context.c
index badd47c..07953a4 100644
--- a/src/gallium/state_trackers/xa/xa_context.c
+++ b/src/gallium/state_trackers/xa/xa_context.c
@@ -116,11 +116,10 @@ xa_surface_dma(struct xa_context *ctx,
 
 	if (to_surface) {
 	    util_copy_rect(map, srf->tex->format, transfer->stride,
-			   0, 0, w, h, data, pitch, boxes->x1, boxes->y1);
+			   0, 0, w, h, data, pitch, 0, 0);
 	} else {
 	    util_copy_rect(data, srf->tex->format, pitch,
-			   boxes->x1, boxes->y1, w, h, map, transfer->stride, 0,
-			   0);
+			   0, 0, w, h, map, transfer->stride, 0, 0);
 	}
 	pipe->transfer_unmap(pipe, transfer);
 	if (to_surface)
-- 
1.8.1.4