[Mesa-dev] [PATCH 4/9] intel/blorp_blit: Fix ptr deref in convert_to_uncompressed

Nanley Chery nanleychery at gmail.com
Wed Sep 26 23:31:06 UTC 2018


Don't access the pointers x and y if they're NULL. Nothing hits this
path currently.
---
 src/intel/blorp/blorp_blit.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/intel/blorp/blorp_blit.c b/src/intel/blorp/blorp_blit.c
index ae3e3c50930..7c4e569e44c 100644
--- a/src/intel/blorp/blorp_blit.c
+++ b/src/intel/blorp/blorp_blit.c
@@ -2456,15 +2456,18 @@ blorp_surf_convert_to_uncompressed(const struct isl_device *isl_dev,
     */
    blorp_surf_convert_to_single_slice(isl_dev, info);
 
-   if (width && height) {
 #ifndef NDEBUG
+   if (width && height && x && y) {
       uint32_t right_edge_px = info->tile_x_sa + *x + *width;
       uint32_t bottom_edge_px = info->tile_y_sa + *y + *height;
       assert(*width % fmtl->bw == 0 ||
              right_edge_px == info->surf.logical_level0_px.width);
       assert(*height % fmtl->bh == 0 ||
              bottom_edge_px == info->surf.logical_level0_px.height);
+   }
 #endif
+
+   if (width && height) {
       *width = DIV_ROUND_UP(*width, fmtl->bw);
       *height = DIV_ROUND_UP(*height, fmtl->bh);
    }
-- 
2.19.0



More information about the mesa-dev mailing list