From 81a7227364ee23a28addb782da91e7b1edd73551 Mon Sep 17 00:00:00 2001 From: "Xiang, Haihao" Date: Fri, 15 Mar 2013 12:51:33 +0800 Subject: [PATCH] Check the object for VA buffer Signed-off-by: Xiang, Haihao --- src/i965_drv_video.c | 53 +++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 50 insertions(+), 3 deletions(-) diff --git a/src/i965_drv_video.c b/src/i965_drv_video.c index 4fa4960..ea124e1 100755 --- a/src/i965_drv_video.c +++ b/src/i965_drv_video.c @@ -1462,9 +1462,12 @@ i965_BufferSetNumElements(VADriverContextP ctx, assert(obj_buffer); + if (!obj_buffer) + return VA_STATUS_ERROR_INVALID_BUFFER; + if ((num_elements < 0) || (num_elements > obj_buffer->max_num_elements)) { - vaStatus = VA_STATUS_ERROR_UNKNOWN; + vaStatus = VA_STATUS_ERROR_MAX_NUM_EXCEEDED; } else { obj_buffer->num_elements = num_elements; if (obj_buffer->buffer_store != NULL) { @@ -1488,6 +1491,9 @@ i965_MapBuffer(VADriverContextP ctx, assert(obj_buffer->buffer_store->bo || obj_buffer->buffer_store->buffer); assert(!(obj_buffer->buffer_store->bo && obj_buffer->buffer_store->buffer)); + if (!obj_buffer || !obj_buffer->buffer_store) + return VA_STATUS_ERROR_INVALID_BUFFER; + if (NULL != obj_buffer->buffer_store->bo) { unsigned int tiling, swizzle; @@ -1567,6 +1573,9 @@ i965_UnmapBuffer(VADriverContextP ctx, VABufferID buf_id) assert(obj_buffer->buffer_store->bo || obj_buffer->buffer_store->buffer); assert(!(obj_buffer->buffer_store->bo && obj_buffer->buffer_store->buffer)); + if (!obj_buffer || !obj_buffer->buffer_store) + return VA_STATUS_ERROR_INVALID_BUFFER; + if (NULL != obj_buffer->buffer_store->bo) { unsigned int tiling, swizzle; @@ -1593,6 +1602,10 @@ i965_DestroyBuffer(VADriverContextP ctx, VABufferID buffer_id) struct object_buffer *obj_buffer = BUFFER(buffer_id); assert(obj_buffer); + + if (!obj_buffer) + return VA_STATUS_ERROR_INVALID_BUFFER; + i965_destroy_buffer(&i965->buffer_heap, (struct object_base *)obj_buffer); return VA_STATUS_SUCCESS; @@ -1766,6 +1779,9 @@ i965_decoder_render_picture(VADriverContextP ctx, struct object_buffer *obj_buffer = BUFFER(buffers[i]); assert(obj_buffer); + if (!obj_buffer) + return VA_STATUS_ERROR_INVALID_BUFFER; + switch (obj_buffer->type) { case VAPictureParameterBufferType: vaStatus = I965_RENDER_DECODE_BUFFER(picture_parameter); @@ -1886,6 +1902,9 @@ i965_encoder_render_picture(VADriverContextP ctx, struct object_buffer *obj_buffer = BUFFER(buffers[i]); assert(obj_buffer); + if (!obj_buffer) + return VA_STATUS_ERROR_INVALID_BUFFER; + switch (obj_buffer->type) { case VAQMatrixBufferType: vaStatus = I965_RENDER_ENCODE_BUFFER(qmatrix); @@ -1976,6 +1995,9 @@ i965_proc_render_picture(VADriverContextP ctx, struct object_buffer *obj_buffer = BUFFER(buffers[i]); assert(obj_buffer); + if (!obj_buffer) + return VA_STATUS_ERROR_INVALID_BUFFER; + switch (obj_buffer->type) { case VAProcPipelineParameterBufferType: vaStatus = I965_RENDER_PROC_BUFFER(pipeline_parameter); @@ -2393,7 +2415,14 @@ i965_CreateImage(VADriverContextP ctx, if (va_status != VA_STATUS_SUCCESS) goto error; - obj_image->bo = BUFFER(image->buf)->buffer_store->bo; + struct object_buffer *obj_buffer = BUFFER(image->buf); + + if (!obj_buffer || + !obj_buffer->buffer_store || + !obj_buffer->buffer_store->bo) + return VA_STATUS_ERROR_ALLOCATION_FAILED; + + obj_image->bo = obj_buffer->buffer_store->bo; dri_bo_reference(obj_image->bo); if (image->num_palette_entries > 0 && image->entry_bytes > 0) { @@ -2743,7 +2772,14 @@ VAStatus i965_DeriveImage(VADriverContextP ctx, if (va_status != VA_STATUS_SUCCESS) goto error; - obj_image->bo = BUFFER(image->buf)->buffer_store->bo; + struct object_buffer *obj_buffer = BUFFER(image->buf); + + if (!obj_buffer || + !obj_buffer->buffer_store || + !obj_buffer->buffer_store->bo) + return VA_STATUS_ERROR_ALLOCATION_FAILED; + + obj_image->bo = obj_buffer->buffer_store->bo; dri_bo_reference(obj_image->bo); if (image->num_palette_entries > 0 && image->entry_bytes > 0) { @@ -3604,6 +3640,11 @@ i965_BufferInfo( i965 = i965_driver_data(ctx); obj_buffer = BUFFER(buf_id); + assert(obj_buffer); + + if (!obj_buffer) + return VA_STATUS_ERROR_INVALID_BUFFER; + *type = obj_buffer->type; *size = obj_buffer->size_element; *num_elements = obj_buffer->num_elements; @@ -4054,6 +4095,12 @@ VAStatus i965_QueryVideoProcPipelineCaps( for (i = 0; i < num_filters; i++) { struct object_buffer *obj_buffer = BUFFER(filters[i]); + + if (!obj_buffer || + !obj_buffer->buffer_store || + !obj_buffer->buffer_store->bo) + return VA_STATUS_ERROR_INVALID_BUFFER; + VAProcFilterParameterBufferBase *base = (VAProcFilterParameterBufferBase *)obj_buffer->buffer_store->buffer; if (base->type == VAProcFilterNoiseReduction) { -- 2.7.4