From: Gwenole Beauchesne <gbeauchesne@splitted-desktop.com>
Date: Mon, 12 Jul 2010 06:34:37 +0000 (+0200)
Subject: Fix vaGetImage() bounds checking code.
X-Git-Tag: libva-1.0.4~12
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e9c00fc43ecc7ccf54b53e36c29bc53fd2eca189;p=platform%2Fupstream%2Flibva.git

Fix vaGetImage() bounds checking code.
---

diff --git a/i965_drv_video/i965_drv_video.c b/i965_drv_video/i965_drv_video.c
index 8f893a1..b8d622d 100644
--- a/i965_drv_video/i965_drv_video.c
+++ b/i965_drv_video/i965_drv_video.c
@@ -1541,9 +1541,11 @@ i965_GetImage(VADriverContextP ctx,
 
     if (x < 0 || y < 0)
         return VA_STATUS_ERROR_INVALID_PARAMETER;
-    if (width > obj_surface->width || height > obj_surface->height)
+    if (x + width > obj_surface->orig_width ||
+        y + height > obj_surface->orig_height)
         return VA_STATUS_ERROR_INVALID_PARAMETER;
-    if (width > obj_image->image.width || height > obj_image->image.height)
+    if (x + width > obj_image->image.width ||
+        y + height > obj_image->image.height)
         return VA_STATUS_ERROR_INVALID_PARAMETER;
 
     VAStatus va_status;