From abff45cff0b89c6b83085345b93286eefa28db88 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@gmail.com>
Date: Thu, 26 Feb 2015 21:21:33 +0100
Subject: [PATCH] transfer: check iov size on all transfers

---
 src/vrend_renderer.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/vrend_renderer.c b/src/vrend_renderer.c
index 917160d..84dafc3 100644
--- a/src/vrend_renderer.c
+++ b/src/vrend_renderer.c
@@ -3687,6 +3687,21 @@ static bool check_transfer_bounds(struct vrend_resource *res,
    return true;
 }
 
+static bool check_iov_bounds(struct vrend_resource *res,
+			     const struct vrend_transfer_info *info,
+			     struct iovec *iov, int num_iovs)
+{
+    int elsize = util_format_get_blocksize(res->base.format);
+    GLuint send_size = util_format_get_nblocks(res->base.format, info->box->width,
+					       info->box->height) * elsize * info->box->depth;
+
+    GLuint iovsize = vrend_get_iovec_size(iov, num_iovs);
+
+    if (iovsize < send_size)
+        return false;
+    return true;
+}
+
 static int vrend_renderer_transfer_write_iov(struct vrend_context *ctx,
 					    struct vrend_resource *res,
 					    struct iovec *iov, int num_iovs,
@@ -4177,6 +4192,9 @@ int vrend_renderer_transfer_iov(const struct vrend_transfer_info *info,
    if (!check_transfer_bounds(res, info->level, info->box))
       return EINVAL;
 
+   if (!check_iov_bounds(res, info, iov, num_iovs))
+      return EINVAL;
+
    if (transfer_mode == VREND_TRANSFER_WRITE)
       return vrend_renderer_transfer_write_iov(ctx, res, iov, num_iovs,
 					       info);