Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=54168
Fix errors introducted in 863d528a9f76d0e8f122aebf19f8564a4c67a938. Said patch does indeed remove the problematic writes to bad memory, however it also introduces errors in the algoritm. This patch has the effect of reverting said patch and adding an if in the proper location to catch the out of bounds memory write without causing problems to the overall algorithm. Signed-off-by: Alex Orange <crazyca...@gmail.com> --- fb/fbseg.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/fb/fbseg.c b/fb/fbseg.c index 1848387..16e0426 100644 --- a/fb/fbseg.c +++ b/fb/fbseg.c @@ -65,12 +65,6 @@ fbBresSolid(DrawablePtr pDrawable, if (axis == X_AXIS) { bits = 0; while (len--) { - if (e >= 0) { - WRITE(dst, FbDoMaskRRop (READ(dst), and, xor, bits)); - bits = 0; - dst += dstStride; - e += e3; - } bits |= mask; mask = fbBresShiftMask(mask, signdx, dstBpp); if (!mask) { @@ -80,12 +74,23 @@ fbBresSolid(DrawablePtr pDrawable, mask = mask0; } e += e1; + if (e >= 0) { + if (bits) { + WRITE(dst, FbDoMaskRRop (READ(dst), and, xor, bits)); + bits = 0; + } + dst += dstStride; + e += e3; + } } if (bits) WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, bits)); } else { while (len--) { + WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, mask)); + dst += dstStride; + e += e1; if (e >= 0) { e += e3; mask = fbBresShiftMask(mask, signdx, dstBpp); @@ -94,9 +99,6 @@ fbBresSolid(DrawablePtr pDrawable, mask = mask0; } } - WRITE(dst, FbDoMaskRRop(READ(dst), and, xor, mask)); - dst += dstStride; - e += e1; } } -- 1.8.5.5 _______________________________________________ xorg-devel@lists.x.org: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel