[Mesa-stable] [PATCH 16/18] i965: Prevent coordinate overflow in intel_emit_linear_blit

[Chris Wilson]

On Fri, Jul 17, 2015 at 05:12:54PM -0700, Anuj Phogat wrote:
> On Mon, Jul 6, 2015 at 3:33 AM, Chris Wilson <chris at chris-wilson.co.uk> wrote:
> > +   do {
> > +      /* The pitch given to the GPU must be DWORD aligned, and
> > +       * we want width to match pitch. Max width is (1 << 15 - 1),
> > +       * rounding that down to the nearest DWORD is 1 << 15 - 4
> > +       */
> > +      pitch = ROUND_DOWN_TO(MIN2(size, (1 << 15) - 64), 4);
> I understand why you are subtracting 64 in above statement, it'll
> be nice to update above comment explaining the reason.

We use the pitch to set the copy width, so the maximum x coordinate
becomes src_x + pitch. Since src_x has a maximum value of 63, we want to
make sure that pitch is less than 32627-63. Simplified above.

> > +      height = (size < pitch || pitch == 0) ? 1 : size / pitch;
...
> > +      pitch *= height;
> > +      if (size <= pitch)
> I think size < pitch will never be true. How about:
> assert(size < pitch);

For a single row copy, size can be less than pitch.
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre