diff options
| author | Ben Skeggs <bskeggs@redhat.com> | 2012-10-18 18:38:21 +1000 |
|---|---|---|
| committer | Ben Skeggs <bskeggs@redhat.com> | 2012-10-18 18:38:21 +1000 |
| commit | 01c9a9cff7d6232ca6eafa59dd60833a0d9cdc5b (patch) | |
| tree | 7de680521f14aff15dbce012a46a528267bed00c | |
| parent | 297fd0d0755bda698be1d0b30cc60a41d7673c0b (diff) | |
| download | xorg-driver-xf86-video-nouveau-01c9a9cff7d6232ca6eafa59dd60833a0d9cdc5b.tar.gz | |
shadowfb: fix segfault due to reading outside of shadow buffer
Probably caused by the new libdrm port, the new libdrm sets the bo
size field to the *allocated* size and not the *requested* size,
making the max_height calculation here invalid.
Switched to using virtualX/virtualY as the bounds, which should
hopefully do the right thing..
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
| -rw-r--r-- | src/nv_shadow.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/src/nv_shadow.c b/src/nv_shadow.c index 67d9ea5..4ad2357 100644 --- a/src/nv_shadow.c +++ b/src/nv_shadow.c @@ -32,19 +32,18 @@ void NVRefreshArea(ScrnInfoPtr pScrn, int num, BoxPtr pbox) { NVPtr pNv = NVPTR(pScrn); - int x1, y1, x2, y2, width, height, cpp, FBPitch, max_height; + int x1, y1, x2, y2, width, height, cpp, FBPitch; unsigned char *src, *dst; cpp = pScrn->bitsPerPixel >> 3; FBPitch = pScrn->displayWidth * cpp; - max_height = pNv->scanout->size/FBPitch; nouveau_bo_map(pNv->scanout, NOUVEAU_BO_WR, pNv->client); while(num--) { x1 = MAX(pbox->x1, 0); y1 = MAX(pbox->y1, 0); - x2 = MIN(pbox->x2, pScrn->displayWidth); - y2 = MIN(pbox->y2, max_height); + x2 = MIN(pbox->x2, pScrn->virtualX); + y2 = MIN(pbox->y2, pScrn->virtualY); width = (x2 - x1) * cpp; height = y2 - y1; |