xf86-video-intel: src/sna/blt.c

[Chris Wilson]

 src/sna/blt.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

New commits:
commit 587c4866652e40e1e228b333028114766a6d3b08
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Mon Nov 4 15:10:40 2013 +0000

    sna: Promote uint16_t to a full int to avoid overflow in computing w*h in memcpy_xor
    
    Reported-by: Conley Moorhous <conleymoorhous at gmail.com>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=70527
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/blt.c b/src/sna/blt.c
index 4c27678..4843a41 100644
--- a/src/sna/blt.c
+++ b/src/sna/blt.c
@@ -948,7 +948,7 @@ memcpy_xor(const void *src, void *dst, int bpp,
 {
 	const uint8_t *src_bytes;
 	uint8_t *dst_bytes;
-	int i;
+	int i, w;
 
 	assert(width && height);
 	assert(bpp >= 8);
@@ -1001,8 +1001,9 @@ memcpy_xor(const void *src, void *dst, int bpp,
 			}
 		case 4:
 #if USE_SSE2
-			if (width * 4 == dst_stride && dst_stride == src_stride) {
-				width *= height;
+			w = width;
+			if (w * 4 == dst_stride && dst_stride == src_stride) {
+				w *= height;
 				height = 1;
 			}
 
@@ -1012,7 +1013,7 @@ memcpy_xor(const void *src, void *dst, int bpp,
 					const uint32_t *s = (const uint32_t *)src_bytes;
 					__m128i mask = xmm_create_mask_32(or);
 
-					i = width;
+					i = w;
 					while (i && (uintptr_t)d & 15) {
 						*d++ = *s++ | or;
 						i--;
@@ -1079,7 +1080,7 @@ memcpy_xor(const void *src, void *dst, int bpp,
 					uint32_t *d = (uint32_t *)dst_bytes;
 					uint32_t *s = (uint32_t *)src_bytes;
 
-					for (i = 0; i < width; i++)
+					for (i = 0; i < w; i++)
 						d[i] = s[i] | or;
 
 					src_bytes += src_stride;