File 0005-cbc8d8b-vrend-check-transfer-bounds-for-negative-values-too-.patch of Package virglrenderer.22702

commit cbc8d8b75be360236cada63784046688aeb6d921
Author: Gert Wollny <gert.wollny@collabora.com>
Date:   Tue Oct 8 16:51:11 2019 +0200

    vrend: check transfer bounds for negative values too and report error
    
    Closes #138
    
    Signed-off-by: Gert Wollny <gert.wollny@collabora.com>
    Reviewed-by: Emil Velikov <emil.velikov@collabora.com>

Index: virglrenderer-0.6.0/src/virgl_hw.h
===================================================================
--- virglrenderer-0.6.0.orig/src/virgl_hw.h
+++ virglrenderer-0.6.0/src/virgl_hw.h
@@ -271,6 +271,7 @@ enum virgl_ctx_errors {
         VIRGL_ERROR_CTX_ILLEGAL_VERTEX_FORMAT,
         VIRGL_ERROR_CTX_ILLEGAL_CMD_BUFFER,
         VIRGL_ERROR_CTX_ILLEGAL_FORMAT,
+        VIRGL_ERROR_CTX_TRANSFER_IOV_BOUNDS,
 };
 
 
Index: virglrenderer-0.6.0/src/vrend_renderer.c
===================================================================
--- virglrenderer-0.6.0.orig/src/vrend_renderer.c
+++ virglrenderer-0.6.0/src/vrend_renderer.c
@@ -461,7 +461,7 @@ static inline const char *pipe_shader_to
    };
 }
 
-static const char *vrend_ctx_error_strings[] = { "None", "Unknown", "Illegal shader", "Illegal handle", "Illegal resource", "Illegal surface", "Illegal vertex format", "Illegal command buffer", "Illegal format ID" };
+static const char *vrend_ctx_error_strings[] = { "None", "Unknown", "Illegal shader", "Illegal handle", "Illegal resource", "Illegal surface", "Illegal vertex format", "Illegal command buffer", "Illegal format ID", "IOV data size exceeds resource capacity" };
 
 static void __report_context_error(const char *fname, struct vrend_context *ctx, enum virgl_ctx_errors error, uint32_t value)
 {
@@ -4518,7 +4518,7 @@ static bool check_transfer_bounds(struct
       return false;
    /* these will catch bad y/z/w/d with 1D textures etc */
    lwidth = u_minify(res->base.width0, info->level);
-   if (info->box->width > lwidth)
+   if (info->box->width > lwidth || info->box->width < 0)
       return false;
    if (info->box->x > lwidth)
       return false;
@@ -4526,7 +4526,7 @@ static bool check_transfer_bounds(struct
       return false;
 
    lheight = u_minify(res->base.height0, info->level);
-   if (info->box->height > lheight)
+   if (info->box->height > lheight || info->box->height < 0)
       return false;
    if (info->box->y > lheight)
       return false;
@@ -4535,7 +4535,7 @@ static bool check_transfer_bounds(struct
 
    if (res->base.target == PIPE_TEXTURE_3D) {
       int ldepth = u_minify(res->base.depth0, info->level);
-      if (info->box->depth > ldepth)
+      if (info->box->depth > ldepth || info->box->depth < 0)
          return false;
       if (info->box->z > ldepth)
          return false;
@@ -5088,10 +5088,15 @@ int vrend_renderer_transfer_iov(const st
       return EINVAL;
    }
 
-   if (!check_transfer_bounds(res, info))
+   if (!check_transfer_bounds(res, info)) {
+      report_context_error(ctx, VIRGL_ERROR_CTX_TRANSFER_IOV_BOUNDS, res->id);
       return EINVAL;
+   }
 
    if (!check_iov_bounds(res, info, iov, num_iovs))
+   if (!check_iov_bounds(res, info, iov, num_iovs)) {
+      report_context_error(ctx, VIRGL_ERROR_CTX_TRANSFER_IOV_BOUNDS, res->id);
+   }
       return EINVAL;
 
    vrend_hw_switch_context(vrend_lookup_renderer_ctx(0), true);