a34caaf1c6
CID 1107540: Make the code safe avoiding random stack access. In the first loop where there is a singleton point to pptSrc, only access that singleton, no matter what. Bump PKGREVISION as well. Originally from Christos Zoulas: http://mail-index.netbsd.org/source-changes/2013/11/14/msg049188.html Reported upstream by Patrick Welche: http://lists.freedesktop.org/archives/intel-gfx/2015-January/059018.html
33 lines
1.1 KiB
C
33 lines
1.1 KiB
C
$NetBSD: patch-src_legacy_i810_i810__dri.c,v 1.1 2015/04/20 13:39:00 khorben Exp $
|
|
|
|
CID 1107540: Make the code safe avoiding random stack access. In
|
|
the first loop where there is a singleton point to pptSrc, only
|
|
access that singleton, no matter what.
|
|
|
|
November 2013 patch from NetBSD xsrc:
|
|
http://mail-index.netbsd.org/source-changes/2013/11/14/msg049188.html
|
|
|
|
--- src/legacy/i810/i810_dri.c.orig 2014-08-29 09:33:11.000000000 +0000
|
|
+++ src/legacy/i810/i810_dri.c
|
|
@@ -1104,10 +1104,17 @@ I810DRIMoveBuffers(WindowPtr pParent, DD
|
|
while ((pboxNext >= pbox) && (pboxBase->y1 == pboxNext->y1))
|
|
pboxNext--;
|
|
pboxTmp = pboxNext + 1;
|
|
- pptTmp = pptSrc + (pboxTmp - pbox);
|
|
- while (pboxTmp <= pboxBase) {
|
|
- *pboxNew1++ = *pboxTmp++;
|
|
- *pptNew1++ = *pptTmp++;
|
|
+ if (pptSrc == &ptOldOrg) {
|
|
+ if (pboxTmp <= pboxBase) {
|
|
+ *pboxNew1++ = *pboxTmp;
|
|
+ *pptNew1++ = *pptSrc;
|
|
+ }
|
|
+ } else {
|
|
+ pptTmp = pptSrc + (pboxTmp - pbox);
|
|
+ while (pboxTmp <= pboxBase) {
|
|
+ *pboxNew1++ = *pboxTmp++;
|
|
+ *pptNew1++ = *pptTmp++;
|
|
+ }
|
|
}
|
|
pboxBase = pboxNext;
|
|
}
|