aboutsummaryrefslogtreecommitdiffstats
path: root/meta/recipes-graphics/xorg-xserver/xserver-xorg/xorg-CVE-2013-6424.patch
blob: 7c6153022f15b0b601de9aa0faeb85056b000a89 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
This patch comes from:
http://lists.x.org/archives/xorg-devel/2013-October/037996.html

Upstream-Status: Backport

Signed-off-by: Baogen shang <baogen.shang@windriver.com>
diff -Naur xorg-server-1.14.0-orig/exa/exa_render.c xorg-server-1.14.0/exa/exa_render.c
--- xorg-server-1.14.0-orig/exa/exa_render.c	2014-02-27 14:32:38.000000000 +0800
+++ xorg-server-1.14.0/exa/exa_render.c	2014-02-27 15:46:59.000000000 +0800
@@ -1141,7 +1141,8 @@
 
         exaPrepareAccess(pPicture->pDrawable, EXA_PREPARE_DEST);
         for (; ntrap; ntrap--, traps++)
-            (*ps->RasterizeTrapezoid) (pPicture, traps, -bounds.x1, -bounds.y1);
+            if (xTrapezoidValid(traps))
+                (*ps->RasterizeTrapezoid) (pPicture, traps, -bounds.x1, -bounds.y1);
         exaFinishAccess(pPicture->pDrawable, EXA_PREPARE_DEST);
 
         xRel = bounds.x1 + xSrc - xDst;
diff -Naur xorg-server-1.14.0-orig/render/picture.h xorg-server-1.14.0/render/picture.h
--- xorg-server-1.14.0-orig/render/picture.h	2014-02-27 14:32:26.000000000 +0800
+++ xorg-server-1.14.0/render/picture.h	2014-02-27 15:48:13.000000000 +0800
@@ -211,7 +211,7 @@
 /* whether 't' is a well defined not obviously empty trapezoid */
 #define xTrapezoidValid(t)  ((t)->left.p1.y != (t)->left.p2.y && \
 			     (t)->right.p1.y != (t)->right.p2.y && \
-			     (int) ((t)->bottom - (t)->top) > 0)
+			     ((t)->bottom > (t)->top))
 
 /*
  * Standard NTSC luminance conversions: