On Sun, 12 Aug 2012 10:01:44 +0100, Russell King - ARM Linux <linux at arm.linux.org.uk> wrote:
> While reading through the Intel driver code, I spotted this in
> I830SetPortAttributeOverlay:
>
> } else if (attribute == xvPipe) {
> xf86CrtcConfigPtr xf86_config = XF86_CRTC_CONFIG_PTR(scrn);
> if ((value < -1) || (value > xf86_config->num_crtc))
> return BadValue;
> if (value < 0)
> adaptor_priv->desired_crtc = NULL;
> else
> adaptor_priv->desired_crtc = xf86_config->crtc[value];
>
> This allows value == xf86_config->num_crtc to be valid, which would be
> the CRTC number _after_ the last one in the array. Presumably this is
> not desired, and the test should be ">=".
Thanks for bringing this to our attention and poking Dave, who promptly
pushed a patch to fix the bug.
-Chris
--
Chris Wilson, Intel Open Source Technology Centre
