<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Tue, Nov 22, 2016 at 9:11 AM, Eduardo Lima Mitev <span dir="ltr"><<a href="mailto:elima@igalia.com" target="_blank">elima@igalia.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">In get_tex_memcpy, when copying texture data directly from source<br>
to destination (when row strides match for both src and dst), the<br>
block size is currently calculated as 'bytes-per-row * image-height',<br>
ignoring the given y-offset argument.<br>
<br>
This can cause a read past the end of the mapped buffer, leading to<br>
a segfault.<br>
<br>
Fixes CTS test (from crash to pass):<br>
* GL45-CTS/get_texture_sub_<wbr>image/functional_test<br>
---<br>
src/mesa/main/texgetimage.c | 2 +-<br>
1 file changed, 1 insertion(+), 1 deletion(-)<br>
<br>
diff --git a/src/mesa/main/texgetimage.c b/src/mesa/main/texgetimage.c<br>
index b900278..a783ed5 100644<br>
--- a/src/mesa/main/texgetimage.c<br>
+++ b/src/mesa/main/texgetimage.c<br>
@@ -654,7 +654,7 @@ get_tex_memcpy(struct gl_context *ctx,<br>
<br>
if (src) {<br>
if (bytesPerRow == dstRowStride && bytesPerRow == srcRowStride) {<br>
- memcpy(dst, src, bytesPerRow * texImage->Height);<br>
+ memcpy(dst, src, bytesPerRow * (texImage->Height - yoffset));<br></blockquote><div><br></div><div>Why not use the height parameter that gets passed in. That seems more correct.<br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
}<br>
else {<br>
GLuint row;<br>
<span class="HOEnZb"><font color="#888888">--<br>
2.10.2<br>
<br>
______________________________<wbr>_________________<br>
mesa-dev mailing list<br>
<a href="mailto:mesa-dev@lists.freedesktop.org">mesa-dev@lists.freedesktop.org</a><br>
<a href="https://lists.freedesktop.org/mailman/listinfo/mesa-dev" rel="noreferrer" target="_blank">https://lists.freedesktop.org/<wbr>mailman/listinfo/mesa-dev</a><br>
</font></span></blockquote></div><br></div></div>