aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authoremersion <contact@emersion.fr>2018-05-30 17:18:51 +0100
committeremersion <contact@emersion.fr>2018-05-30 19:46:24 +0100
commitf90b024ad0ee2d746404e3240393fd4f13a884d1 (patch)
tree27c37d753a076f8463d47c06b5c0e062eebf07a5
parent135721118a719ecacfd2bd83524a9c53c6ca6015 (diff)
linux-dmabuf: fix bound checks for stride and height
- Fix bound checking for offset + stride * height - Make offset bound checking more consistent - Reject zero strides
-rw-r--r--types/wlr_linux_dmabuf.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/types/wlr_linux_dmabuf.c b/types/wlr_linux_dmabuf.c
index 542f8cbc..6e716986 100644
--- a/types/wlr_linux_dmabuf.c
+++ b/types/wlr_linux_dmabuf.c
@@ -207,7 +207,7 @@ static void params_create_common(struct wl_client *client,
// Skip checks if kernel does no support seek on buffer
continue;
}
- if (buffer->attributes.offset[i] >= size) {
+ if (buffer->attributes.offset[i] > size) {
wl_resource_post_error(params_resource,
ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_OUT_OF_BOUNDS,
"invalid offset %i for plane %d",
@@ -215,7 +215,8 @@ static void params_create_common(struct wl_client *client,
goto err_out;
}
- if (buffer->attributes.offset[i] + buffer->attributes.stride[i] > size) {
+ if (buffer->attributes.offset[i] + buffer->attributes.stride[i] > size ||
+ buffer->attributes.stride[i] == 0) {
wl_resource_post_error(params_resource,
ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_OUT_OF_BOUNDS,
"invalid stride %i for plane %d",
@@ -225,7 +226,7 @@ static void params_create_common(struct wl_client *client,
// planes > 0 might be subsampled according to fourcc format
if (i == 0 && buffer->attributes.offset[i] +
- buffer->attributes.stride[i] * height >= size) {
+ buffer->attributes.stride[i] * height > size) {
wl_resource_post_error(params_resource,
ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_OUT_OF_BOUNDS,
"invalid buffer stride or height for plane %d", i);