From: Vadym Shovkoplias <vadym.shovkoplias@globallogic.com>
Date: Mon, 27 Nov 2017 10:15:13 +0000 (+0200)
Subject: intel/blorp: Fix possible NULL pointer dereferencing
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=cdb3eb7174f84f3200408c4b43c819fb093da9c6;p=mesa.git

intel/blorp: Fix possible NULL pointer dereferencing

Fix incomplete check of input params in blorp_surf_convert_to_uncompressed()
which can lead to NULL pointer dereferencing.

Fixes: 5ae8043fed2 ("intel/blorp: Add an entrypoint for doing
bit-for-bit copies")
Fixes: f395d0abc83 ("intel/blorp: Internally expose
surf_convert_to_uncompressed")
Reviewed-by: Emil Velikov <emli.velikov@collabora.com>
Reviewed-by: Andres Gomez <agomez@igalia.com>
---

diff --git a/src/intel/blorp/blorp_blit.c b/src/intel/blorp/blorp_blit.c
index d119a99b31f..0757db0d04b 100644
--- a/src/intel/blorp/blorp_blit.c
+++ b/src/intel/blorp/blorp_blit.c
@@ -2351,7 +2351,7 @@ blorp_surf_convert_to_uncompressed(const struct isl_device *isl_dev,
     */
    blorp_surf_convert_to_single_slice(isl_dev, info);
 
-   if (width || height) {
+   if (width && height) {
 #ifndef NDEBUG
       uint32_t right_edge_px = info->tile_x_sa + *x + *width;
       uint32_t bottom_edge_px = info->tile_y_sa + *y + *height;
@@ -2364,7 +2364,7 @@ blorp_surf_convert_to_uncompressed(const struct isl_device *isl_dev,
       *height = DIV_ROUND_UP(*height, fmtl->bh);
    }
 
-   if (x || y) {
+   if (x && y) {
       assert(*x % fmtl->bw == 0);
       assert(*y % fmtl->bh == 0);
       *x /= fmtl->bw;