[Mesa-stable] [PATCH 16/18] i965: Prevent coordinate overflow in intel_emit_linear_blit

[Anuj Phogat]

On Sat, Jul 18, 2015 at 1:24 AM, Chris Wilson <chris at chris-wilson.co.uk> wrote:
> On Fri, Jul 17, 2015 at 05:12:54PM -0700, Anuj Phogat wrote:
>> On Mon, Jul 6, 2015 at 3:33 AM, Chris Wilson <chris at chris-wilson.co.uk> wrote:
>> > +   do {
>> > +      /* The pitch given to the GPU must be DWORD aligned, and
>> > +       * we want width to match pitch. Max width is (1 << 15 - 1),
>> > +       * rounding that down to the nearest DWORD is 1 << 15 - 4
>> > +       */
>> > +      pitch = ROUND_DOWN_TO(MIN2(size, (1 << 15) - 64), 4);
>> I understand why you are subtracting 64 in above statement, it'll
>> be nice to update above comment explaining the reason.
>
> We use the pitch to set the copy width, so the maximum x coordinate
> becomes src_x + pitch. Since src_x has a maximum value of 63, we want to
> make sure that pitch is less than 32627-63. Simplified above.
>
>> > +      height = (size < pitch || pitch == 0) ? 1 : size / pitch;
> ...
>> > +      pitch *= height;
>> > +      if (size <= pitch)
>> I think size < pitch will never be true. How about:
>> assert(size < pitch);
>
> For a single row copy, size can be less than pitch.
right.

Reviewed-by: Anuj Phogat <anuj.phogat at gmail.com>
> -Chris
>
> --
> Chris Wilson, Intel Open Source Technology Centre
> _______________________________________________
> mesa-stable mailing list
> mesa-stable at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/mesa-stable