[Mesa-dev] [PATCH] st/va: Fix potential buffer overread

[Leo Liu]

On 2018-04-24 07:01 PM, Drew Davenport wrote:
> VASurfaceAttribExternalBuffers.pitches is indexed by
> plane. Current implementation only supports single plane layout.
Reviewed-by: Leo Liu <leo.liu at amd.com>

> ---
>   src/gallium/state_trackers/va/surface.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/gallium/state_trackers/va/surface.c b/src/gallium/state_trackers/va/surface.c
> index 8604136944..6fe21b89e5 100644
> --- a/src/gallium/state_trackers/va/surface.c
> +++ b/src/gallium/state_trackers/va/surface.c
> @@ -574,7 +574,7 @@ suface_from_external_memory(VADriverContextP ctx, vlVaSurface *surface,
>      memset(&whandle, 0, sizeof(struct winsys_handle));
>      whandle.type = DRM_API_HANDLE_TYPE_FD;
>      whandle.handle = memory_attibute->buffers[index];
> -   whandle.stride = memory_attibute->pitches[index];
> +   whandle.stride = memory_attibute->pitches[0];
>   
>      resource = pscreen->resource_from_handle(pscreen, &res_templ, &whandle,
>                                               PIPE_HANDLE_USAGE_READ_WRITE);