dri: Check buffer height and avoid overflow
The dri2_allocate_buffer() can be called with arbitrary height, however
the struct pipe_resource .height0 member is uint16_t. Check height for
maximum size to avoid overflow. Note that .width0 is unsigned int, so
it does not have the same issue.
The uint16 limit comes from commit:
e6428092f5
("gallium: decrease the size of pipe_resource - 64 -> 48 bytes")
The overflow can be triggered e.g. by requesting large BO:
```
gbm_bo_create(dev, 1, 640*480*4, GBM_FORMAT_R8, GBM_BO_USE_LINEAR);
```
Signed-off-by: Marek Vasut <marex@denx.de>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/16513>
This commit is contained in:
parent
3b36700162
commit
c73cc1785a
|
@ -304,6 +304,10 @@ dri2_allocate_buffer(__DRIscreen *sPriv,
|
|||
unsigned bind = 0;
|
||||
struct winsys_handle whandle;
|
||||
|
||||
/* struct pipe_resource height0 is 16-bit, avoid overflow */
|
||||
if (height > 0xffff)
|
||||
return NULL;
|
||||
|
||||
switch (attachment) {
|
||||
case __DRI_BUFFER_FRONT_LEFT:
|
||||
case __DRI_BUFFER_FAKE_FRONT_LEFT:
|
||||
|
|
Loading…
Reference in New Issue