diff options
| author | Gwenole Beauchesne <gbeauchesne@splitted-desktop.com> | 2010-07-12 08:34:37 +0200 |
|---|---|---|
| committer | Xiang, Haihao <haihao.xiang@intel.com> | 2010-07-12 15:45:05 +0800 |
| commit | e9c00fc43ecc7ccf54b53e36c29bc53fd2eca189 (patch) | |
| tree | 3add75d75a0ad2a35ca87508fc55701eaa98ab5d | |
| parent | 777c69c2394eeb37dfe6143de80c3d6e05579aac (diff) | |
| download | libva-e9c00fc43ecc7ccf54b53e36c29bc53fd2eca189.tar.gz | |
Fix vaGetImage() bounds checking code.
| -rw-r--r-- | i965_drv_video/i965_drv_video.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/i965_drv_video/i965_drv_video.c b/i965_drv_video/i965_drv_video.c index 8f893a1..b8d622d 100644 --- a/i965_drv_video/i965_drv_video.c +++ b/i965_drv_video/i965_drv_video.c @@ -1541,9 +1541,11 @@ i965_GetImage(VADriverContextP ctx, if (x < 0 || y < 0) return VA_STATUS_ERROR_INVALID_PARAMETER; - if (width > obj_surface->width || height > obj_surface->height) + if (x + width > obj_surface->orig_width || + y + height > obj_surface->orig_height) return VA_STATUS_ERROR_INVALID_PARAMETER; - if (width > obj_image->image.width || height > obj_image->image.height) + if (x + width > obj_image->image.width || + y + height > obj_image->image.height) return VA_STATUS_ERROR_INVALID_PARAMETER; VAStatus va_status; |