The VASurfaceAttribExternalBuffers structure contains a four element array
of pitches, one for each plane. suface_from_external_memory() indexes into
this array using a passed in index, which is in the range 0 to
num_surfaces-1. num_surfaces is the number of surfaces, not planes.
Consequently the indexing is incorrect and will overflow the array.
Since suface_from_external_memory() has already checked that the number of
planes is 1 (line 553), the only valid index into pitches[] is 0.
Signed-off-by: Paul Parsons <lost.dista...@yahoo.com>
---
diff -ru a/src/gallium/state_trackers/va/surface.c
b/src/gallium/state_trackers/va/surface.c
--- a/src/gallium/state_trackers/va/surface.c 2017-12-08 13:49:11.000000000
+0000
+++ b/src/gallium/state_trackers/va/surface.c 2017-12-17 13:02:36.395911318
+0000
@@ -571,7 +571,7 @@
memset(&whandle, 0, sizeof(struct winsys_handle));
whandle.type = DRM_API_HANDLE_TYPE_FD;
whandle.handle = memory_attibute->buffers[index];
- whandle.stride = memory_attibute->pitches[index];
+ whandle.stride = memory_attibute->pitches[0];
resource = pscreen->resource_from_handle(pscreen, &res_templ, &whandle,
PIPE_HANDLE_USAGE_READ_WRITE);
_______________________________________________
mesa-dev mailing list
mesa-dev@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/mesa-dev
