summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLucas Stach <l.stach@pengutronix.de>2016-12-13 20:20:50 +0100
committerRussell King <rmk@armlinux.org.uk>2017-02-04 12:26:04 +0000
commit1bfe2e6254dd41e55f5662662d4e1f9cef979aa9 (patch)
treea015b38b58b56833401eaff2d03454adfc7640c8
parent6b1abe15db6b650cd5c940c77884966b7b27f1e5 (diff)
etnaviv: fall back if composite region is bigger than src or mask
Having a composite region bigger than the src or mask picture is well defined as per the X.Org renderproto spec chapter "9. Source and Mask Transformations". We can not do this on the GPU as the core is not clipping the source size in relative mode and there is no way to control the behavior in absolute mode. This is especially visible on a GPU with MMUv2, where such operations will cause MMU faults, as the GPU tries to read outside of the source buffer. On MMUv1 it will only cause reading of undefined data. Signed-off-by: Lucas Stach <l.stach@pengutronix.de> Signed-off-by: Russell King <rmk@armlinux.org.uk>
-rw-r--r--etnaviv/etnaviv_render.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/etnaviv/etnaviv_render.c b/etnaviv/etnaviv_render.c
index c4f87cd..a46c1bb 100644
--- a/etnaviv/etnaviv_render.c
+++ b/etnaviv/etnaviv_render.c
@@ -413,6 +413,9 @@ static struct etnaviv_pixmap *etnaviv_acquire_src(ScreenPtr pScreen,
if (!vSrc)
goto fallback;
+ if (vSrc->width < clip->x2 || vSrc->height < clip->y2)
+ goto fallback;
+
etnaviv_set_format(vSrc, pict);
if (!etnaviv_src_format_valid(etnaviv, vSrc->pict_format))
goto fallback;
@@ -671,6 +674,9 @@ static int etnaviv_accel_composite_masked(PicturePtr pSrc, PicturePtr pMask,
if (!vMask)
goto fallback;
+ if (vMask->width < clip_temp.x2 || vMask->height < clip_temp.y2)
+ goto fallback;
+
mask_offset.x += mo.x;
mask_offset.y += mo.y;
} else {