Mir

Code review comment for lp:~alan-griffiths/mir/mesa-hybrid-cursor

Revision history for this message
Alan Griffiths (alan-griffiths) wrote :

> +{
> 87 + const_cast<gbm_bo*&>(from.buffer) = nullptr;
> 88 + const_cast<gbm_device*&>(from.device) = nullptr;
>
> Seems like undefined behavior.

Fixed

> 165 + memset(dest, 0, buffer_stride * (gbm_bo_get_height(buffer) -
> image_height));
>
> "gbm_bo_get_height(buffer) - image_height" could be negative and implicitly
> converted to size_t (so a huge number - Needs a check.

Unless I'm missing something (always possible) there is a check Vis:

    if (image_width > min_buffer_width || image_height > min_buffer_height)
    {
        BOOST_THROW_EXCEPTION(std::logic_error("Image is too big for GBM cursor buffer"));
    }

AIUI min_buffer_height ought to be <= gbm_bo_get_height(buffer)

« Back to merge proposal