Skip to content
Commit 69ab094a authored by Olivier Fourdan's avatar Olivier Fourdan Committed by Adam Jackson
Browse files

glamor: Avoid overflow between box32 and box16 box

glamor_compute_transform_clipped_regions() uses a temporary box32
internally which is copied back to a box16 to init the regions16,
thus causing a potential overflow.

If an overflow occurs, the given region is invalid and the pixmap
init region will fail.

Simply check that the coordinates won't overflow when copying back to
the box16, avoiding a crash later down the line in glamor.

Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=101894


Signed-off-by: default avatarOlivier Fourdan <ofourdan@redhat.com>
Tested-by: default avatarFabrice Bellet <fabrice@bellet.info>
Reviewed-by: default avatarAdam Jackson <ajax@redhat.com>
(cherry picked from commit 9869dcb3)
parent 421814bc
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment