[Mesa-dev] [PATCH] intel/blorp: Fix possible NULL pointer dereferencing
From: Vadym Shovkoplias Fix incomplete check of input params in blorp_surf_convert_to_uncompressed() which can lead to NULL pointer dereferencing. --- src/intel/blorp/blorp_blit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/intel/blorp/blorp_blit.c b/src/intel/blorp/blorp_blit.c index 9b5c1f1..8abd0db 100644 --- a/src/intel/blorp/blorp_blit.c +++ b/src/intel/blorp/blorp_blit.c @@ -2343,7 +2343,7 @@ blorp_surf_convert_to_uncompressed(const struct isl_device *isl_dev, */ blorp_surf_convert_to_single_slice(isl_dev, info); - if (width || height) { + if (width && height) { #ifndef NDEBUG uint32_t right_edge_px = info->tile_x_sa + *x + *width; uint32_t bottom_edge_px = info->tile_y_sa + *y + *height; @@ -2356,7 +2356,7 @@ blorp_surf_convert_to_uncompressed(const struct isl_device *isl_dev, *height = DIV_ROUND_UP(*height, fmtl->bh); } - if (x || y) { + if (x && y) { assert(*x % fmtl->bw == 0); assert(*y % fmtl->bh == 0); *x /= fmtl->bw; -- 2.7.4 ___ mesa-dev mailing list mesa-dev@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/mesa-dev
[Mesa-dev] [PATCH] intel/blorp: Fix possible NULL pointer dereferencing
From: Vadym Shovkoplias Fix incomplete check of input params in blorp_surf_convert_to_uncompressed() which can lead to NULL pointer dereferencing. --- src/intel/blorp/blorp_blit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/intel/blorp/blorp_blit.c b/src/intel/blorp/blorp_blit.c index 9b5c1f1..8abd0db 100644 --- a/src/intel/blorp/blorp_blit.c +++ b/src/intel/blorp/blorp_blit.c @@ -2343,7 +2343,7 @@ blorp_surf_convert_to_uncompressed(const struct isl_device *isl_dev, */ blorp_surf_convert_to_single_slice(isl_dev, info); - if (width || height) { + if (width && height) { #ifndef NDEBUG uint32_t right_edge_px = info->tile_x_sa + *x + *width; uint32_t bottom_edge_px = info->tile_y_sa + *y + *height; @@ -2356,7 +2356,7 @@ blorp_surf_convert_to_uncompressed(const struct isl_device *isl_dev, *height = DIV_ROUND_UP(*height, fmtl->bh); } - if (x || y) { + if (x && y) { assert(*x % fmtl->bw == 0); assert(*y % fmtl->bh == 0); *x /= fmtl->bw; -- 2.7.4 ___ mesa-dev mailing list mesa-dev@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/mesa-dev
Re: [Mesa-dev] [PATCH] intel/blorp: Fix possible NULL pointer dereferencing
On Wed, 2017-11-29 at 17:53 +0200, Vadym Shovkoplias wrote: > Hi Andres, > > Thanks for the review! > I'm not familiar with Mesa workflow so far so I'll appreciate any > help in pushing this patch. You are welcome ... ... and pushed ☺ -- Br, Andres ___ mesa-dev mailing list mesa-dev@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/mesa-dev
Re: [Mesa-dev] [PATCH] intel/blorp: Fix possible NULL pointer dereferencing
Hi Vadym, Welcome to Mesa. On 27 November 2017 at 14:41, wrote: > From: Vadym Shovkoplias > > Fix incomplete check of input params in blorp_surf_convert_to_uncompressed() > which can lead to NULL pointer dereferencing. Nicely spotted. Fortunately, all the callers do the sane thing so in practise this cannot crash ;-) Fixes: 5ae8043fed2 ("intel/blorp: Add an entrypoint for doing bit-for-bit copies") Fixes: f395d0abc83 ("intel/blorp: Internally expose surf_convert_to_uncompressed") Reviewed-by: Emil Velikov -Emil ___ mesa-dev mailing list mesa-dev@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/mesa-dev
Re: [Mesa-dev] [PATCH] intel/blorp: Fix possible NULL pointer dereferencing
This is: Reviewed-by: Andres Gomez Vadym, let me know if you need someone to push your change. On Mon, 2017-11-27 at 12:15 +0200, vadim.shovkopl...@gmail.com wrote: > From: Vadym Shovkoplias > > Fix incomplete check of input params in blorp_surf_convert_to_uncompressed() > which can lead to NULL pointer dereferencing. > > --- > src/intel/blorp/blorp_blit.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/src/intel/blorp/blorp_blit.c b/src/intel/blorp/blorp_blit.c > index 9b5c1f1..8abd0db 100644 > --- a/src/intel/blorp/blorp_blit.c > +++ b/src/intel/blorp/blorp_blit.c > @@ -2343,7 +2343,7 @@ blorp_surf_convert_to_uncompressed(const struct > isl_device *isl_dev, > */ > blorp_surf_convert_to_single_slice(isl_dev, info); > > - if (width || height) { > + if (width && height) { > #ifndef NDEBUG >uint32_t right_edge_px = info->tile_x_sa + *x + *width; >uint32_t bottom_edge_px = info->tile_y_sa + *y + *height; > @@ -2356,7 +2356,7 @@ blorp_surf_convert_to_uncompressed(const struct > isl_device *isl_dev, >*height = DIV_ROUND_UP(*height, fmtl->bh); > } > > - if (x || y) { > + if (x && y) { >assert(*x % fmtl->bw == 0); >assert(*y % fmtl->bh == 0); >*x /= fmtl->bw; -- Br, Andres signature.asc Description: This is a digitally signed message part ___ mesa-dev mailing list mesa-dev@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/mesa-dev