[src/trunk]: src/sys/dev/rasops Fix a critical bug for rasops_copyrows() intr...

[rin <rin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/636fd75dd12b
branches:  trunk
changeset: 964559:636fd75dd12b
user:      rin <rin%NetBSD.org@localhost>
date:      Wed Aug 07 11:03:14 2019 +0000

description:
Fix a critical bug for rasops_copyrows() introduced in rev. 1.90:
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/dev/rasops/rasops.c#rev1.90

When src < dst, we have to copy backward.

diffstat:

 sys/dev/rasops/rasops.c |  26 ++++++++++++++++++--------
 1 files changed, 18 insertions(+), 8 deletions(-)

diffs (54 lines):

diff -r efc9faa84649 -r 636fd75dd12b sys/dev/rasops/rasops.c
--- a/sys/dev/rasops/rasops.c   Wed Aug 07 10:59:51 2019 +0000
+++ b/sys/dev/rasops/rasops.c   Wed Aug 07 11:03:14 2019 +0000
@@ -1,4 +1,4 @@
-/*      $NetBSD: rasops.c,v 1.112 2019/08/07 10:59:51 rin Exp $        */
+/*      $NetBSD: rasops.c,v 1.113 2019/08/07 11:03:14 rin Exp $        */
 
 /*-
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: rasops.c,v 1.112 2019/08/07 10:59:51 rin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: rasops.c,v 1.113 2019/08/07 11:03:14 rin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_rasops.h"
@@ -726,19 +726,29 @@
        n = ri->ri_emustride;
        stride = ri->ri_stride;
 
-       sp = ri->ri_bits + src * ri->ri_yscale;
-       dp = ri->ri_bits + dst * ri->ri_yscale;
+       src *= ri->ri_yscale;
+       dst *= ri->ri_yscale;
+
+       if (src < dst) {
+               /* backward copy */
+               src += (num - 1) * stride;
+               dst += (num - 1) * stride;
+               stride *= -1;
+       }
+
+       sp = ri->ri_bits + src;
+       dp = ri->ri_bits + dst;
        if (ri->ri_hwbits)
-               hp = ri->ri_hwbits + dst * ri->ri_yscale;
+               hp = ri->ri_hwbits + dst;
 
        while (num--) {
                memcpy(dp, sp, n);
-               dp += stride;
+               sp += stride;
                if (ri->ri_hwbits) {
-                       memcpy(hp, sp, n);
+                       memcpy(hp, dp, n);
                        hp += stride;
                }
-               sp += stride;
+               dp += stride;
        }
 }