[Mesa-dev] [PATCH 1/2] intel: blorp: fix potential NULL pointer dereferences

[Jason Ekstrand]

This patch is technically correct (the best kind of correct!) but I'm not
sure I like it.  width/height and x/y will always come in pairs.  This
makes the code messier just to get rid of a coverity warning that can
easily be verified to never be an issue (by just looking at all 3 callers).

--Jason

On Mon, Oct 9, 2017 at 7:37 AM, Lionel Landwerlin <
lionel.g.landwerlin at intel.com> wrote:

> CID: 1418616, 1418607
> Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin at intel.com>
> ---
>  src/intel/blorp/blorp_blit.c | 16 +++++++++++-----
>  1 file changed, 11 insertions(+), 5 deletions(-)
>
> diff --git a/src/intel/blorp/blorp_blit.c b/src/intel/blorp/blorp_blit.c
> index 11c2116a758..84e46d7d31b 100644
> --- a/src/intel/blorp/blorp_blit.c
> +++ b/src/intel/blorp/blorp_blit.c
> @@ -2343,23 +2343,29 @@ blorp_surf_convert_to_uncompressed(const struct
> isl_device *isl_dev,
>      */
>     blorp_surf_convert_to_single_slice(isl_dev, info);
>
> -   if (width || height) {
> +   if (width) {
>  #ifndef NDEBUG
>        uint32_t right_edge_px = info->tile_x_sa + *x + *width;
> -      uint32_t bottom_edge_px = info->tile_y_sa + *y + *height;
>        assert(*width % fmtl->bw == 0 ||
>               right_edge_px == info->surf.logical_level0_px.width);
> +#endif
> +      *width = DIV_ROUND_UP(*width, fmtl->bw);
> +   }
> +   if (height) {
> +#ifndef NDEBUG
> +      uint32_t bottom_edge_px = info->tile_y_sa + *y + *height;
>        assert(*height % fmtl->bh == 0 ||
>               bottom_edge_px == info->surf.logical_level0_px.height);
>  #endif
> -      *width = DIV_ROUND_UP(*width, fmtl->bw);
>        *height = DIV_ROUND_UP(*height, fmtl->bh);
>     }
>
> -   if (x || y) {
> +   if (x) {
>        assert(*x % fmtl->bw == 0);
> -      assert(*y % fmtl->bh == 0);
>        *x /= fmtl->bw;
> +   }
> +   if (y) {
> +      assert(*y % fmtl->bh == 0);
>        *y /= fmtl->bh;
>     }
>
> --
> 2.14.2
>
> _______________________________________________
> mesa-dev mailing list
> mesa-dev at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/mesa-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/mesa-dev/attachments/20171009/aa0bef55/attachment-0001.html>