[Mesa-stable] [PATCH 16/18] i965: Prevent coordinate overflow in intel_emit_linear_blit

[Emil Velikov]

On 1 August 2015 at 17:57, Emil Velikov <emil.l.velikov at gmail.com> wrote:
> Hello all,
>
> On 20 July 2015 at 18:08, Anuj Phogat <anuj.phogat at gmail.com> wrote:
>> On Sat, Jul 18, 2015 at 1:24 AM, Chris Wilson <chris at chris-wilson.co.uk> wrote:
>>> On Fri, Jul 17, 2015 at 05:12:54PM -0700, Anuj Phogat wrote:
>>>> On Mon, Jul 6, 2015 at 3:33 AM, Chris Wilson <chris at chris-wilson.co.uk> wrote:
>>>> > +   do {
>>>> > +      /* The pitch given to the GPU must be DWORD aligned, and
>>>> > +       * we want width to match pitch. Max width is (1 << 15 - 1),
>>>> > +       * rounding that down to the nearest DWORD is 1 << 15 - 4
>>>> > +       */
>>>> > +      pitch = ROUND_DOWN_TO(MIN2(size, (1 << 15) - 64), 4);
>>>> I understand why you are subtracting 64 in above statement, it'll
>>>> be nice to update above comment explaining the reason.
>>>
>>> We use the pitch to set the copy width, so the maximum x coordinate
>>> becomes src_x + pitch. Since src_x has a maximum value of 63, we want to
>>> make sure that pitch is less than 32627-63. Simplified above.
>>>
>>>> > +      height = (size < pitch || pitch == 0) ? 1 : size / pitch;
>>> ...
>>>> > +      pitch *= height;
>>>> > +      if (size <= pitch)
>>>> I think size < pitch will never be true. How about:
>>>> assert(size < pitch);
>>>
>>> For a single row copy, size can be less than pitch.
>> right.
>>
>> Reviewed-by: Anuj Phogat <anuj.phogat at gmail.com>
> It doesn't seem that the patch has landed in master despite the review
> from Anuj. Is it missing something or did it fell through the cracks ?
>
Another humble ping !

-Emil