8e9b95
From f24c4b2e3803f2b0e4eb7de5288756c4f9758ad5 Mon Sep 17 00:00:00 2001
8e9b95
From: Adam Jackson <ajax@redhat.com>
8e9b95
Date: Thu, 21 Apr 2011 16:41:14 -0400
8e9b95
Subject: [PATCH] fb: fix memcpy abuse
8e9b95
8e9b95
Signed-off-by: Adam Jackson <ajax@redhat.com>
8e9b95
---
8e9b95
 fb/fbblt.c |    9 +++++++--
8e9b95
 1 files changed, 7 insertions(+), 2 deletions(-)
8e9b95
8e9b95
diff --git a/fb/fbblt.c b/fb/fbblt.c
8e9b95
index 38271c0..980ad5a 100644
8e9b95
--- a/fb/fbblt.c
8e9b95
+++ b/fb/fbblt.c
8e9b95
@@ -65,6 +65,7 @@ fbBlt (FbBits   *srcLine,
8e9b95
     int	    n, nmiddle;
8e9b95
     Bool    destInvarient;
8e9b95
     int	    startbyte, endbyte;
8e9b95
+    int     careful;
8e9b95
     FbDeclareMergeRop ();
8e9b95
 
8e9b95
 #ifdef FB_24BIT
8e9b95
@@ -76,12 +77,16 @@ fbBlt (FbBits   *srcLine,
8e9b95
     }
8e9b95
 #endif
8e9b95
 
8e9b95
-    if (alu == GXcopy && pm == FB_ALLONES && !reverse &&
8e9b95
+    careful = !((srcLine < dstLine && srcLine + width * (bpp/8) > dstLine) ||
8e9b95
+                (dstLine < srcLine && dstLine + width * (bpp/8) > srcLine)) ||
8e9b95
+              (bpp % 8);
8e9b95
+
8e9b95
+    if (alu == GXcopy && pm == FB_ALLONES && !careful &&
8e9b95
             !(srcX & 7) && !(dstX & 7) && !(width & 7)) {
8e9b95
         int i;
8e9b95
         CARD8 *src = (CARD8 *) srcLine;
8e9b95
         CARD8 *dst = (CARD8 *) dstLine;
8e9b95
-        
8e9b95
+
8e9b95
         srcStride *= sizeof(FbBits);
8e9b95
         dstStride *= sizeof(FbBits);
8e9b95
         width >>= 3;
8e9b95
-- 
8e9b95
1.7.4.4
8e9b95