From: Nanley Chery <nanley.g.ch...@intel.com> The fast path for Intel's ReadPixels() unintentionally omits clipping the specified area to a valid one. Rather than clip in various corner-cases, perform this operation in the API validation stage.
The bug in intel_readpixels_tiled_memcpy() showed itself when the winsys ReadBuffer's height was smaller than the one specified by ReadPixels(). yoffset became negative, which was an invalid input for tiled_to_linear(). v2: Move clipping to validation stage (Jason) Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92193 Reported-by: Marta Löfstedt <marta.lofst...@intel.com> Cc: "11.0 11.1" <mesa-sta...@lists.freedesktop.org> Signed-off-by: Nanley Chery <nanley.g.ch...@intel.com> --- src/mesa/main/readpix.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/mesa/main/readpix.c b/src/mesa/main/readpix.c index 8cdc9fe..a5b74bc 100644 --- a/src/mesa/main/readpix.c +++ b/src/mesa/main/readpix.c @@ -993,6 +993,7 @@ _mesa_ReadnPixelsARB( GLint x, GLint y, GLsizei width, GLsizei height, { GLenum err = GL_NO_ERROR; struct gl_renderbuffer *rb; + struct gl_pixelstore_attrib clippedPacking; GET_CURRENT_CONTEXT(ctx); @@ -1094,7 +1095,9 @@ _mesa_ReadnPixelsARB( GLint x, GLint y, GLsizei width, GLsizei height, } } - if (width == 0 || height == 0) + /* Do all needed clipping here, so that we can forget about it later */ + clippedPacking = ctx->Pack; + if (!_mesa_clip_readpixels(ctx, &x, &y, &width, &height, &clippedPacking)) return; /* nothing to do */ if (!_mesa_validate_pbo_access(2, &ctx->Pack, width, height, 1, @@ -1118,7 +1121,7 @@ _mesa_ReadnPixelsARB( GLint x, GLint y, GLsizei width, GLsizei height, } ctx->Driver.ReadPixels(ctx, x, y, width, height, - format, type, &ctx->Pack, pixels); + format, type, &clippedPacking, pixels); } void GLAPIENTRY -- 2.7.0 _______________________________________________ mesa-dev mailing list mesa-dev@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/mesa-dev