From e078b2ca6224eae323a0064884e0be7c7c2cd8e3 Mon Sep 17 00:00:00 2001 From: Gwenole Beauchesne Date: Mon, 12 Jul 2010 08:34:37 +0200 Subject: [PATCH] Fix vaGetImage() bounds checking code. --- i965_drv_video.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/i965_drv_video.c b/i965_drv_video.c index 8f893a1..b8d622d 100644 --- a/i965_drv_video.c +++ b/i965_drv_video.c @@ -1541,9 +1541,11 @@ i965_GetImage(VADriverContextP ctx, if (x < 0 || y < 0) return VA_STATUS_ERROR_INVALID_PARAMETER; - if (width > obj_surface->width || height > obj_surface->height) + if (x + width > obj_surface->orig_width || + y + height > obj_surface->orig_height) return VA_STATUS_ERROR_INVALID_PARAMETER; - if (width > obj_image->image.width || height > obj_image->image.height) + if (x + width > obj_image->image.width || + y + height > obj_image->image.height) return VA_STATUS_ERROR_INVALID_PARAMETER; VAStatus va_status; -- 2.7.4