From: Christos Zoulas <christos@xxxxxxxxxx> CID 1107540: Make the code safe avoiding random stack access. In the first loop where there is a singleton point to pptSrc, only access that singleton, no matter what. November 2013 patch from NetBSD xsrc: http://mail-index.netbsd.org/source-changes/2013/11/14/msg049188.html Signed-off-by: Patrick Welche <prlw1@xxxxxxxxx> --- src/legacy/i810/i810_dri.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/src/legacy/i810/i810_dri.c b/src/legacy/i810/i810_dri.c index cca35d6..edfbad2 100644 --- a/src/legacy/i810/i810_dri.c +++ b/src/legacy/i810/i810_dri.c @@ -1104,10 +1104,17 @@ I810DRIMoveBuffers(WindowPtr pParent, DDXPointRec ptOldOrg, while ((pboxNext >= pbox) && (pboxBase->y1 == pboxNext->y1)) pboxNext--; pboxTmp = pboxNext + 1; - pptTmp = pptSrc + (pboxTmp - pbox); - while (pboxTmp <= pboxBase) { - *pboxNew1++ = *pboxTmp++; - *pptNew1++ = *pptTmp++; + if (pptSrc == &ptOldOrg) { + if (pboxTmp <= pboxBase) { + *pboxNew1++ = *pboxTmp; + *pptNew1++ = *pptSrc; + } + } else { + pptTmp = pptSrc + (pboxTmp - pbox); + while (pboxTmp <= pboxBase) { + *pboxNew1++ = *pboxTmp++; + *pptNew1++ = *pptTmp++; + } } pboxBase = pboxNext; } -- 2.2.1 _______________________________________________ Intel-gfx mailing list Intel-gfx@xxxxxxxxxxxxxxxxxxxxx http://lists.freedesktop.org/mailman/listinfo/intel-gfx
