Array bound check

Signed-off-by: Xiang, Haihao <haihao.xiang@intel.com>

3 files changed, 18 insertions, 3 deletions

diff --git a/va/egl/va_egl.c b/va/egl/va_egl.c
index 2c6c2b4..48ff7a1 100644
--- a/va/egl/va_egl.c
+++ b/va/egl/va_egl.c
@@ -183,7 +183,7 @@ int vaMaxNumSurfaceTargetsEGL(
     if (va_egl)
         return va_egl->max_egl_surface_targets;
     else
-        return 2;
+        return IMPL_MAX_EGL_SURFACE_TARGETS;
 }
 
 int vaMaxNumSurfaceAttributesEGL(
@@ -200,7 +200,7 @@ int vaMaxNumSurfaceAttributesEGL(
     if (va_egl)
         return va_egl->max_egl_surface_attributes;
     else
-        return 2;
+        return IMPL_MAX_EGL_SURFACE_ATTRIBUTES;
 }
 
 VAStatus vaQuerySurfaceTargetsEGL(
diff --git a/va/egl/va_egl_impl.c b/va/egl/va_egl_impl.c
index 2aa2bbe..367f43f 100644
--- a/va/egl/va_egl_impl.c
+++ b/va/egl/va_egl_impl.c
@@ -282,8 +282,10 @@ vaQuerySurfaceTargetsEGL_impl_libva(VADisplay dpy,
 {
     int i = 0;
 
+    /* FIXME: support other targets ??? */
     target_list[i++] = EGL_NATIVE_PIXMAP_KHR;
     *num_targets = i;
+    assert(i <= IMPL_MAX_EGL_SURFACE_TARGETS);
 
     return VA_STATUS_SUCCESS;
 }
@@ -297,6 +299,10 @@ vaCreateSurfaceEGL_impl_libva(VADisplay dpy,
 {
     VASurfaceImplEGLP pSurfaceImplEGL = NULL;
 
+    /* So far only support for EGL_NATIVE_PIXMAP_KHR */
+    if (target != 0 && target != EGL_NATIVE_PIXMAP_KHR)
+        return VA_STATUS_ERROR_INVALID_PARAMETER;
+
     pSurfaceImplEGL = calloc(1, sizeof(*pSurfaceImplEGL));
 
     if (!pSurfaceImplEGL) {
@@ -400,18 +406,23 @@ vaGetSurfaceInfoEGL_impl_libva(VADisplay dpy,
     if (pSurfaceImplEGL->surface == VA_INVALID_SURFACE)
         return VA_STATUS_ERROR_INVALID_SURFACE;
 
+    if (*num_attribs < IMPL_MAX_EGL_SURFACE_ATTRIBUTES)
+        return VA_STATUS_ERROR_INVALID_PARAMETER;
+
     *target = pSurfaceImplEGL->target;
     *buffer = pSurfaceImplEGL->buffer;
 
     if (pSurfaceImplEGL->target == EGL_NATIVE_PIXMAP_KHR) {
         attrib_list[i++] = EGL_IMAGE_PRESERVED_KHR;
-        attrib_list[i++] = EGL_TRUE;
+        attrib_list[i + 1] = EGL_TRUE;
         attrib_list[i++] = EGL_NONE;
     } else {
         /* FIXME later */
         attrib_list[i++] = EGL_NONE;
     }
 
+    *num_attribs = i;
+
     return VA_STATUS_SUCCESS;
 }
 
diff --git a/va/egl/va_egl_impl.h b/va/egl/va_egl_impl.h
index 96bc9a8..7d4b6f5 100644
--- a/va/egl/va_egl_impl.h
+++ b/va/egl/va_egl_impl.h
@@ -1,6 +1,10 @@
 #ifndef _VA_EGL_IMPL_H_
 #define _VA_EGL_IMPL_H_
 
+#define IMPL_MAX_EGL_SURFACE_TARGETS    4
+#define IMPL_MAX_EGL_SURFACE_ATTRIBUTES 8
+
+
 /**
  * Initialize EGL driver context
  *