CVS commit: src/sys/dev/rasops

[Rin Okuyama]

Module Name:    src
Committed By:   rin
Date:           Wed Aug  7 11:03:14 UTC 2019

Modified Files:
        src/sys/dev/rasops: rasops.c

Log Message:
Fix a critical bug for rasops_copyrows() introduced in rev. 1.90:
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/rasops/rasops.c#rev1.90

When src < dst, we have to copy backward.


To generate a diff of this commit:
cvs rdiff -u -r1.112 -r1.113 src/sys/dev/rasops/rasops.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/dev/rasops/rasops.c
diff -u src/sys/dev/rasops/rasops.c:1.112 src/sys/dev/rasops/rasops.c:1.113
--- src/sys/dev/rasops/rasops.c:1.112	Wed Aug  7 10:59:51 2019
+++ src/sys/dev/rasops/rasops.c	Wed Aug  7 11:03:14 2019
@@ -1,4 +1,4 @@
-/*	 $NetBSD: rasops.c,v 1.112 2019/08/07 10:59:51 rin Exp $	*/
+/*	 $NetBSD: rasops.c,v 1.113 2019/08/07 11:03:14 rin Exp $	*/
 
 /*-
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: rasops.c,v 1.112 2019/08/07 10:59:51 rin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: rasops.c,v 1.113 2019/08/07 11:03:14 rin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_rasops.h"
@@ -726,19 +726,29 @@ rasops_copyrows(void *cookie, int src, i
 	n = ri->ri_emustride;
 	stride = ri->ri_stride;
 
-	sp = ri->ri_bits + src * ri->ri_yscale;
-	dp = ri->ri_bits + dst * ri->ri_yscale;
+	src *= ri->ri_yscale;
+	dst *= ri->ri_yscale;
+
+	if (src < dst) {
+		/* backward copy */
+		src += (num - 1) * stride;
+		dst += (num - 1) * stride;
+		stride *= -1;
+	}
+
+	sp = ri->ri_bits + src;
+	dp = ri->ri_bits + dst;
 	if (ri->ri_hwbits)
-		hp = ri->ri_hwbits + dst * ri->ri_yscale;
+		hp = ri->ri_hwbits + dst;
 
 	while (num--) {
 		memcpy(dp, sp, n);
-		dp += stride;
+		sp += stride;
 		if (ri->ri_hwbits) {
-			memcpy(hp, sp, n);
+			memcpy(hp, dp, n);
 			hp += stride;
 		}
-		sp += stride;
+		dp += stride;
 	}
 }