On Tue, Oct 9, 2018 at 4:32 PM <boyuan.zh...@amd.com> wrote: > > From: Boyuan Zhang <boyuan.zh...@amd.com> > > vlVaGetImage should respect the width, height, and coordinates x and y that > passed in. Therefore, pipe_box should be created with the passed in values > instead of surface width/height. > > v2: add input size check, return error when size out of bounds > v3: fix the size check for vaimage > > Signed-off-by: Boyuan Zhang <boyuan.zh...@amd.com> > Cc: "18.2" <mesa-sta...@lists.freedesktop.org> > Reviewed-by: Leo Liu <leo....@amd.com> > --- > src/gallium/state_trackers/va/image.c | 26 +++++++++++++++++++++++--- > 1 file changed, 23 insertions(+), 3 deletions(-) > > diff --git a/src/gallium/state_trackers/va/image.c > b/src/gallium/state_trackers/va/image.c > index 3f892c9..71d2f49 100644 > --- a/src/gallium/state_trackers/va/image.c > +++ b/src/gallium/state_trackers/va/image.c > @@ -353,6 +353,23 @@ vlVaGetImage(VADriverContextP ctx, VASurfaceID surface, > int x, int y, > return VA_STATUS_ERROR_INVALID_IMAGE; > } > > + if (x < 0 || y < 0) { > + mtx_unlock(&drv->mutex); > + return VA_STATUS_ERROR_INVALID_PARAMETER; > + } > + > + if (x + width > surf->templat.width || > + y + height > surf->templat.height) { > + mtx_unlock(&drv->mutex); > + return VA_STATUS_ERROR_INVALID_PARAMETER; > + } > + > + if (width > vaimage->width || > + height > vaimage->height) { > + mtx_unlock(&drv->mutex); > + return VA_STATUS_ERROR_INVALID_PARAMETER; > + } > + > img_buf = handle_table_get(drv->htab, vaimage->buf); > if (!img_buf) { > mtx_unlock(&drv->mutex); > @@ -400,11 +417,14 @@ vlVaGetImage(VADriverContextP ctx, VASurfaceID surface, > int x, int y, > } > > for (i = 0; i < vaimage->num_planes; i++) { > - unsigned width, height; > + unsigned w = align(width, 2); > + unsigned h = align(height, 2); > if (!views[i]) continue; > - vlVaVideoSurfaceSize(surf, i, &width, &height); > + vl_video_buffer_adjust_size(&w, &h, i, > + surf->templat.chroma_format, > + surf->templat.interlaced);
You should adjust the x/y coords too (and probably round them down to 2, i.e. & ~1). Same transformation as for the w/h ought to work. All this round-by-2 stuff seems sketchy though. It's clearly bogus for the RGB formats, but it does seem prevalent elsewhere. I don't think it's necessary to fix here. Cheers, -ilia > for (j = 0; j < views[i]->texture->array_size; ++j) { > - struct pipe_box box = {0, 0, j, width, height, 1}; > + struct pipe_box box = {x, y, j, w, h, 1}; > struct pipe_transfer *transfer; > uint8_t *map; > map = drv->pipe->transfer_map(drv->pipe, views[i]->texture, 0, > -- > 2.7.4 > _______________________________________________ mesa-dev mailing list mesa-dev@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/mesa-dev