[Mesa-dev] [Mesa-stable] [PATCH 16/18] i965: Prevent coordinate overflow in intel_emit_linear_blit

[Chris Wilson]

On Tue, Sep 01, 2015 at 02:48:20PM +0100, Emil Velikov wrote:
> On 1 August 2015 at 17:57, Emil Velikov <emil.l.velikov at gmail.com> wrote:
> > Hello all,
> >
> > On 20 July 2015 at 18:08, Anuj Phogat <anuj.phogat at gmail.com> wrote:
> >> On Sat, Jul 18, 2015 at 1:24 AM, Chris Wilson <chris at chris-wilson.co.uk> wrote:
> >>> On Fri, Jul 17, 2015 at 05:12:54PM -0700, Anuj Phogat wrote:
> >>>> On Mon, Jul 6, 2015 at 3:33 AM, Chris Wilson <chris at chris-wilson.co.uk> wrote:
> >>>> > +   do {
> >>>> > +      /* The pitch given to the GPU must be DWORD aligned, and
> >>>> > +       * we want width to match pitch. Max width is (1 << 15 - 1),
> >>>> > +       * rounding that down to the nearest DWORD is 1 << 15 - 4
> >>>> > +       */
> >>>> > +      pitch = ROUND_DOWN_TO(MIN2(size, (1 << 15) - 64), 4);
> >>>> I understand why you are subtracting 64 in above statement, it'll
> >>>> be nice to update above comment explaining the reason.
> >>>
> >>> We use the pitch to set the copy width, so the maximum x coordinate
> >>> becomes src_x + pitch. Since src_x has a maximum value of 63, we want to
> >>> make sure that pitch is less than 32627-63. Simplified above.
> >>>
> >>>> > +      height = (size < pitch || pitch == 0) ? 1 : size / pitch;
> >>> ...
> >>>> > +      pitch *= height;
> >>>> > +      if (size <= pitch)
> >>>> I think size < pitch will never be true. How about:
> >>>> assert(size < pitch);
> >>>
> >>> For a single row copy, size can be less than pitch.
> >> right.
> >>
> >> Reviewed-by: Anuj Phogat <anuj.phogat at gmail.com>
> > It doesn't seem that the patch has landed in master despite the review
> > from Anuj. Is it missing something or did it fell through the cracks ?
> >
> Another humble ping !

I keep missing mesa-bugzilla updates, I see there is a tested-by now
which is what I was waiting for.
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre