xf86-video-intel: src/sna/sna_accel.c

[Chris Wilson]

 src/sna/sna_accel.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

New commits:
commit 0e6aca90c7b0b9edd5873034bcf0f3d8b2a9f065
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Tue Oct 29 13:50:51 2013 +0000

    sna: asserts bitmap uploads are correct
    
    Place guards around the pointer accesses to verify that they are within
    the bitmap.
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c
index 16d76a2..a429f73 100644
--- a/src/sna/sna_accel.c
+++ b/src/sna/sna_accel.c
@@ -4549,9 +4549,12 @@ sna_put_xybitmap_blt(DrawablePtr drawable, GCPtr gc, RegionPtr region,
 		src_stride -= bw;
 		do {
 			int i = bw;
+			assert(src >= (uint8_t *)bits);
 			do {
 				*dst++ = byte_reverse(*src++);
 			} while (--i);
+			assert(src <= (uint8_t *)bits + BitmapBytePad(w) * h);
+			assert(dst <= (uint8_t *)ptr + kgem_bo_size(upload));
 			dst += bstride;
 			src += src_stride;
 		} while (--bh);
@@ -4679,9 +4682,12 @@ sna_put_xypixmap_blt(DrawablePtr drawable, GCPtr gc, RegionPtr region,
 			src_stride -= bw;
 			do {
 				int j = bw;
+				assert(src >= (uint8_t *)bits);
 				do {
 					*dst++ = byte_reverse(*src++);
 				} while (--j);
+				assert(src <= (uint8_t *)bits + BitmapBytePad(w) * h);
+				assert(dst <= (uint8_t *)ptr + kgem_bo_size(upload));
 				dst += bstride;
 				src += src_stride;
 			} while (--bh);
@@ -7401,11 +7407,13 @@ sna_copy_bitmap_blt(DrawablePtr _bitmap, DrawablePtr drawable, GCPtr gc,
 			src_stride -= bstride;
 			do {
 				int i = bstride;
+				assert(src >= (uint8_t *)bitmap->devPrivate.ptr);
 				do {
 					*dst++ = byte_reverse(*src++);
 					*dst++ = byte_reverse(*src++);
 					i -= 2;
 				} while (i);
+				assert(src <= (uint8_t *)bitmap->devPrivate.ptr + bitmap->devKind * bitmap->drawable.height);
 				src += src_stride;
 			} while (--bh);
 		} else {
@@ -7457,11 +7465,14 @@ sna_copy_bitmap_blt(DrawablePtr _bitmap, DrawablePtr drawable, GCPtr gc,
 			src_stride -= bstride;
 			do {
 				int i = bstride;
+				assert(src >= (uint8_t *)bitmap->devPrivate.ptr);
 				do {
 					*dst++ = byte_reverse(*src++);
 					*dst++ = byte_reverse(*src++);
 					i -= 2;
 				} while (i);
+				assert(src <= (uint8_t *)bitmap->devPrivate.ptr + bitmap->devKind * bitmap->drawable.height);
+				assert(dst <= (uint8_t *)ptr + kgem_bo_size(upload));
 				src += src_stride;
 			} while (--bh);