diff options
| author | emersion <contact@emersion.fr> | 2018-05-30 17:18:51 +0100 |
|---|---|---|
| committer | emersion <contact@emersion.fr> | 2018-05-30 19:46:24 +0100 |
| commit | f90b024ad0ee2d746404e3240393fd4f13a884d1 (patch) | |
| tree | 27c37d753a076f8463d47c06b5c0e062eebf07a5 | |
| parent | 135721118a719ecacfd2bd83524a9c53c6ca6015 (diff) | |
| download | wlroots-f90b024ad0ee2d746404e3240393fd4f13a884d1.tar.xz | |
linux-dmabuf: fix bound checks for stride and height
- Fix bound checking for offset + stride * height
- Make offset bound checking more consistent
- Reject zero strides
| -rw-r--r-- | types/wlr_linux_dmabuf.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/types/wlr_linux_dmabuf.c b/types/wlr_linux_dmabuf.c index 542f8cbc..6e716986 100644 --- a/types/wlr_linux_dmabuf.c +++ b/types/wlr_linux_dmabuf.c @@ -207,7 +207,7 @@ static void params_create_common(struct wl_client *client, // Skip checks if kernel does no support seek on buffer continue; } - if (buffer->attributes.offset[i] >= size) { + if (buffer->attributes.offset[i] > size) { wl_resource_post_error(params_resource, ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_OUT_OF_BOUNDS, "invalid offset %i for plane %d", @@ -215,7 +215,8 @@ static void params_create_common(struct wl_client *client, goto err_out; } - if (buffer->attributes.offset[i] + buffer->attributes.stride[i] > size) { + if (buffer->attributes.offset[i] + buffer->attributes.stride[i] > size || + buffer->attributes.stride[i] == 0) { wl_resource_post_error(params_resource, ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_OUT_OF_BOUNDS, "invalid stride %i for plane %d", @@ -225,7 +226,7 @@ static void params_create_common(struct wl_client *client, // planes > 0 might be subsampled according to fourcc format if (i == 0 && buffer->attributes.offset[i] + - buffer->attributes.stride[i] * height >= size) { + buffer->attributes.stride[i] * height > size) { wl_resource_post_error(params_resource, ZWP_LINUX_BUFFER_PARAMS_V1_ERROR_OUT_OF_BOUNDS, "invalid buffer stride or height for plane %d", i); |