[Mesa-dev] [PATCH] intel/blorp: Fix possible NULL pointer dereferencing

[Andres Gomez]

This is:

Reviewed-by: Andres Gomez <agomez at igalia.com>

Vadym, let me know if you need someone to push your change.

On Mon, 2017-11-27 at 12:15 +0200, vadim.shovkoplias at gmail.com wrote:
> From: Vadym Shovkoplias <vadym.shovkoplias at globallogic.com>
> 
> Fix incomplete check of input params in blorp_surf_convert_to_uncompressed()
> which can lead to NULL pointer dereferencing.
> 
> ---
>  src/intel/blorp/blorp_blit.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/src/intel/blorp/blorp_blit.c b/src/intel/blorp/blorp_blit.c
> index 9b5c1f1..8abd0db 100644
> --- a/src/intel/blorp/blorp_blit.c
> +++ b/src/intel/blorp/blorp_blit.c
> @@ -2343,7 +2343,7 @@ blorp_surf_convert_to_uncompressed(const struct isl_device *isl_dev,
>      */
>     blorp_surf_convert_to_single_slice(isl_dev, info);
>  
> -   if (width || height) {
> +   if (width && height) {
>  #ifndef NDEBUG
>        uint32_t right_edge_px = info->tile_x_sa + *x + *width;
>        uint32_t bottom_edge_px = info->tile_y_sa + *y + *height;
> @@ -2356,7 +2356,7 @@ blorp_surf_convert_to_uncompressed(const struct isl_device *isl_dev,
>        *height = DIV_ROUND_UP(*height, fmtl->bh);
>     }
>  
> -   if (x || y) {
> +   if (x && y) {
>        assert(*x % fmtl->bw == 0);
>        assert(*y % fmtl->bh == 0);
>        *x /= fmtl->bw;
-- 
Br,

Andres
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part
URL: <https://lists.freedesktop.org/archives/mesa-dev/attachments/20171128/09fe3919/attachment.sig>