xf86-video-ati: Branch 'r6xx-r7xx-support'
Alex Deucher
agd5f at kemper.freedesktop.org
Mon Feb 9 16:56:48 PST 2009
src/r600_exa.c | 20 ++++++++++++++++++++
src/r600_textured_videofuncs.c | 5 +++++
2 files changed, 25 insertions(+)
New commits:
commit 1b4afc1c9f8458f9ab3434418f4ccf959f532ac1
Author: Alex Deucher <alexdeucher at gmail.com>
Date: Mon Feb 9 19:50:37 2009 -0500
R6xx/R7xx: Add checks to make sure we don't overrun VB space
diff --git a/src/r600_exa.c b/src/r600_exa.c
index 9b6d197..598a5ac 100644
--- a/src/r600_exa.c
+++ b/src/r600_exa.c
@@ -262,6 +262,11 @@ R600Solid(PixmapPtr pPix, int x1, int y1, int x2, int y2)
struct r6xx_solid_vertex vertex[3];
struct r6xx_solid_vertex *solid_vb = (pointer)((char*)accel_state->ib->address + (accel_state->ib->total / 2));
+ if (((accel_state->vb_index + 3) * 8) > (accel_state->ib->total / 2)) {
+ ErrorF("Ran out of VB space!\n");
+ return;
+ }
+
vertex[0].x = (float)x1;
vertex[0].y = (float)y1;
@@ -600,6 +605,11 @@ R600AppendCopyVertex(ScrnInfoPtr pScrn,
struct r6xx_copy_vertex *copy_vb = (pointer)((char*)accel_state->ib->address + (accel_state->ib->total / 2));
struct r6xx_copy_vertex vertex[3];
+ if (((accel_state->vb_index + 3) * 16) > (accel_state->ib->total / 2)) {
+ ErrorF("Ran out of VB space!\n");
+ return;
+ }
+
vertex[0].x = (float)dstX;
vertex[0].y = (float)dstY;
vertex[0].s = (float)srcX;
@@ -1901,6 +1911,11 @@ static void R600Composite(PixmapPtr pDst,
struct r6xx_comp_mask_vertex vertex[3];
xPointFixed maskTopLeft, maskTopRight, maskBottomLeft, maskBottomRight;
+ if (((accel_state->vb_index + 3) * 24) > (accel_state->ib->total / 2)) {
+ ErrorF("Ran out of VB space!\n");
+ return;
+ }
+
maskTopLeft.x = IntToxFixed(maskX);
maskTopLeft.y = IntToxFixed(maskY);
maskTopRight.x = IntToxFixed(maskX + w);
@@ -1957,6 +1972,11 @@ static void R600Composite(PixmapPtr pDst,
(pointer)((char*)accel_state->ib->address + (accel_state->ib->total / 2));
struct r6xx_comp_vertex vertex[3];
+ if (((accel_state->vb_index + 3) * 16) > (accel_state->ib->total / 2)) {
+ ErrorF("Ran out of VB space!\n");
+ return;
+ }
+
vertex[0].x = (float)dstX;
vertex[0].y = (float)dstY;
vertex[0].src_s = xFixedToFloat(srcTopLeft.x) / accel_state->texW[0];
diff --git a/src/r600_textured_videofuncs.c b/src/r600_textured_videofuncs.c
index 24bba07..82de88a 100644
--- a/src/r600_textured_videofuncs.c
+++ b/src/r600_textured_videofuncs.c
@@ -406,6 +406,11 @@ R600DisplayTexturedVideo(ScrnInfoPtr pScrn, RADEONPortPrivPtr pPriv)
struct r6xx_copy_vertex *xv_vb = (pointer)((char*)accel_state->ib->address + (accel_state->ib->total / 2));
struct r6xx_copy_vertex vertex[3];
+ if (((accel_state->vb_index + 3) * 16) > (accel_state->ib->total / 2)) {
+ ErrorF("Ran out of VB space!\n");
+ break;
+ }
+
dstX = pBox->x1 + dstxoff;
dstY = pBox->y1 + dstyoff;
dstw = pBox->x2 - pBox->x1;
More information about the xorg-commit
mailing list