[Mesa-dev] [PATCH 1/2] intel: blorp: fix potential NULL pointer dereferences

[Antia Puentes]

Reviewed-by: Antia Puentes <apuentes at igalia.com>


On 09/10/17 16:37, Lionel Landwerlin wrote:
> CID: 1418616, 1418607
> Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin at intel.com>
> ---
>   src/intel/blorp/blorp_blit.c | 16 +++++++++++-----
>   1 file changed, 11 insertions(+), 5 deletions(-)
>
> diff --git a/src/intel/blorp/blorp_blit.c b/src/intel/blorp/blorp_blit.c
> index 11c2116a758..84e46d7d31b 100644
> --- a/src/intel/blorp/blorp_blit.c
> +++ b/src/intel/blorp/blorp_blit.c
> @@ -2343,23 +2343,29 @@ blorp_surf_convert_to_uncompressed(const struct isl_device *isl_dev,
>       */
>      blorp_surf_convert_to_single_slice(isl_dev, info);
>   
> -   if (width || height) {
> +   if (width) {
>   #ifndef NDEBUG
>         uint32_t right_edge_px = info->tile_x_sa + *x + *width;
> -      uint32_t bottom_edge_px = info->tile_y_sa + *y + *height;
>         assert(*width % fmtl->bw == 0 ||
>                right_edge_px == info->surf.logical_level0_px.width);
> +#endif
> +      *width = DIV_ROUND_UP(*width, fmtl->bw);
> +   }
> +   if (height) {
> +#ifndef NDEBUG
> +      uint32_t bottom_edge_px = info->tile_y_sa + *y + *height;
>         assert(*height % fmtl->bh == 0 ||
>                bottom_edge_px == info->surf.logical_level0_px.height);
>   #endif
> -      *width = DIV_ROUND_UP(*width, fmtl->bw);
>         *height = DIV_ROUND_UP(*height, fmtl->bh);
>      }
>   
> -   if (x || y) {
> +   if (x) {
>         assert(*x % fmtl->bw == 0);
> -      assert(*y % fmtl->bh == 0);
>         *x /= fmtl->bw;
> +   }
> +   if (y) {
> +      assert(*y % fmtl->bh == 0);
>         *y /= fmtl->bh;
>      }
>   

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/mesa-dev/attachments/20171009/a81e2959/attachment.html>