Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=54168

Fix errors introducted in 863d528a9f76d0e8f122aebf19f8564a4c67a938. Said
patch does indeed remove the problematic writes to bad memory, however
it also introduces errors in the algoritm. This patch has the effect of
reverting said patch and adding an if in the proper location to catch
the out of bounds memory write without causing problems to the overall
algorithm.

Signed-off-by: Alex Orange <crazyca...@gmail.com>
---
 fb/fbseg.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/fb/fbseg.c b/fb/fbseg.c
index 1848387..16e0426 100644
--- a/fb/fbseg.c
+++ b/fb/fbseg.c
@@ -65,12 +65,6 @@ fbBresSolid(DrawablePtr pDrawable,
     if (axis == X_AXIS) {
         bits = 0;
         while (len--) {
-            if (e >= 0) {
-                WRITE(dst, FbDoMaskRRop (READ(dst), and, xor, bits));
-                bits = 0;
-                dst += dstStride;
-                e += e3;
-            }
             bits |= mask;
             mask = fbBresShiftMask(mask, signdx, dstBpp);
             if (!mask) {
@@ -80,12 +74,23 @@ fbBresSolid(DrawablePtr pDrawable,
                 mask = mask0;
             }
             e += e1;
+            if (e >= 0) {
+                if (bits) {
+                    WRITE(dst, FbDoMaskRRop (READ(dst), and, xor, bits));
+                    bits = 0;
+                }
+                dst += dstStride;
+                e += e3;
+            }
         }
         if (bits)
             WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, bits));
     }
     else {
         while (len--) {
+            WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, mask));
+            dst += dstStride;
+            e += e1;
             if (e >= 0) {
                 e += e3;
                 mask = fbBresShiftMask(mask, signdx, dstBpp);
@@ -94,9 +99,6 @@ fbBresSolid(DrawablePtr pDrawable,
                     mask = mask0;
                 }
             }
-            WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, mask));
-            dst += dstStride;
-            e += e1;
         }
     }
 
-- 
1.8.5.5

_______________________________________________
xorg-devel@lists.x.org: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: http://lists.x.org/mailman/listinfo/xorg-devel

Reply via email to