diff options
| author | Zhao Yakui <yakui.zhao@intel.com> | 2013-10-15 11:01:04 +0800 |
|---|---|---|
| committer | Xiang, Haihao <haihao.xiang@intel.com> | 2013-11-13 15:33:04 +0800 |
| commit | daede78837ea4384df4c10dce9f7fabef4f31a17 (patch) | |
| tree | 28b14a09348bdd62d113c9e2bfef14a89e0972bc /src/i965_drv_video.c | |
| parent | 7b6c3bfa1111b26a5519438a9eca67ff88d7ef04 (diff) | |
| download | libva-intel-driver-daede78837ea4384df4c10dce9f7fabef4f31a17.tar.gz libva-intel-driver-daede78837ea4384df4c10dce9f7fabef4f31a17.tar.bz2 libva-intel-driver-daede78837ea4384df4c10dce9f7fabef4f31a17.zip | |
Add more strict check to fix crash issue caused by invalid parameter
This is to fix the crash issue in https://bugs.freedesktop.org/show_bug.cgi?id=70397
Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
(cherry picked from commit 80d665eb670fd700d03f9a2486e452947177a058)
Diffstat (limited to 'src/i965_drv_video.c')
| -rwxr-xr-x | src/i965_drv_video.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/src/i965_drv_video.c b/src/i965_drv_video.c index af0a2fa..6b81fb0 100755 --- a/src/i965_drv_video.c +++ b/src/i965_drv_video.c @@ -1816,6 +1816,9 @@ i965_UnmapBuffer(VADriverContextP ctx, VABufferID buf_id) struct object_buffer *obj_buffer = BUFFER(buf_id); VAStatus vaStatus = VA_STATUS_ERROR_UNKNOWN; + if ((buf_id & OBJECT_HEAP_OFFSET_MASK) != BUFFER_ID_OFFSET) + return VA_STATUS_ERROR_INVALID_BUFFER; + assert(obj_buffer && obj_buffer->buffer_store); assert(obj_buffer->buffer_store->bo || obj_buffer->buffer_store->buffer); assert(!(obj_buffer->buffer_store->bo && obj_buffer->buffer_store->buffer)); @@ -2024,7 +2027,6 @@ i965_decoder_render_picture(VADriverContextP ctx, for (i = 0; i < num_buffers && vaStatus == VA_STATUS_SUCCESS; i++) { struct object_buffer *obj_buffer = BUFFER(buffers[i]); - assert(obj_buffer); if (!obj_buffer) return VA_STATUS_ERROR_INVALID_BUFFER; @@ -2147,7 +2149,6 @@ i965_encoder_render_picture(VADriverContextP ctx, for (i = 0; i < num_buffers; i++) { struct object_buffer *obj_buffer = BUFFER(buffers[i]); - assert(obj_buffer); if (!obj_buffer) return VA_STATUS_ERROR_INVALID_BUFFER; @@ -2240,7 +2241,6 @@ i965_proc_render_picture(VADriverContextP ctx, for (i = 0; i < num_buffers && vaStatus == VA_STATUS_SUCCESS; i++) { struct object_buffer *obj_buffer = BUFFER(buffers[i]); - assert(obj_buffer); if (!obj_buffer) return VA_STATUS_ERROR_INVALID_BUFFER; @@ -2275,7 +2275,10 @@ i965_RenderPicture(VADriverContextP ctx, if (!obj_context) return VA_STATUS_ERROR_INVALID_CONTEXT; - + + if (num_buffers <= 0) + return VA_STATUS_ERROR_INVALID_PARAMETER; + obj_config = obj_context->obj_config; assert(obj_config); |