Fix out-of-bound read in memcpy calls

src/media_drv_common.h

@@ -39,6 +39,6 @@
 #define BRC_INIT_IGNORE_PICTURE_HEADER_SIZE     0x2000
 #define BRC_INIT_DISABLE_MBBRC                  0x8000
 
-UINT SEARCH_PATH_TABLE[2][8][16];
-UINT ME_CURBE_INIT_DATA[30];
+extern UINT SEARCH_PATH_TABLE[2][8][16];
+extern UINT ME_CURBE_INIT_DATA[30];
 #endif

src/media_drv_gen75_render.c

@@ -1453,7 +1453,7 @@ media_drv_gen75_render_init(VADriverContextP ctx)
 
     if (IS_HASWELL (drv_ctx->drv_data.device_id)) {
         memcpy(render_state->render_kernels, render_kernels_gen7_haswell,
-               sizeof(render_state->render_kernels));
+               sizeof(render_kernels_gen7_haswell));
         render_state->render_put_surface = gen7_render_put_surface;
         render_state->render_put_subpicture = gen7_render_put_subpicture;
     } else {

src/media_drv_gen8_render.c

@@ -1741,7 +1741,7 @@ media_drv_gen8_render_init(VADriverContextP ctx)
     render_state->max_wm_threads = 64;
 
     memcpy(render_state->render_kernels, render_kernels_gen8,
-           sizeof(render_state->render_kernels));
+           sizeof(render_kernels_gen8));
 
     kernel_size = 4096;
 

src/media_drv_hw_g75.c

@@ -3325,7 +3325,7 @@ media_set_curbe_vp8_me (VP8_ME_CURBE_PARAMS * params)
   MEDIA_CURBE_DATA_ME *cmd = (MEDIA_CURBE_DATA_ME *) params->curbe_cmd_buff;
 
   media_drv_memcpy (cmd, sizeof (MEDIA_CURBE_DATA_ME), ME_CURBE_INIT_DATA,
-		    sizeof (MEDIA_CURBE_DATA_ME));
+		    sizeof (ME_CURBE_INIT_DATA));
   me_mode =
     params->
     me_16x_enabled ? (params->me_16x ? ME16x_BEFORE_ME4x : ME4x_AFTER_ME16x) :

src/media_drv_init.c

@@ -2774,4 +2774,13 @@ __vaDriverInit_0_34 (VADriverContextP ctx)
   return ret;
 }
 
+VAStatus DLL_EXPORT VA_DRIVER_INIT_FUNC (VADriverContextP ctx);
+VAStatus
+VA_DRIVER_INIT_FUNC (VADriverContextP ctx)
+{
+  VAStatus ret = VA_STATUS_ERROR_UNKNOWN;
+
+  ret = va_driver_init (ctx);
+  return ret;
+}
 

src/media_drv_output_dri.c

@@ -105,13 +105,23 @@ media_output_dri_init (VADriverContextP ctx)
   struct dri_vtable *dri_vtable;
 
   static const struct dso_symbol symbols[] = {
+#if VA_CHECK_VERSION(1,0,0)
+    {"va_dri_get_drawable",
+     offsetof (struct dri_vtable, get_drawable)},
+    {"va_dri_get_rendering_buffer",
+     offsetof (struct dri_vtable, get_rendering_buffer)},
+    {"va_dri_swap_buffer",
+     offsetof (struct dri_vtable, swap_buffer)},
+    {NULL,}
+#else
     {"dri_get_drawable",
      offsetof (struct dri_vtable, get_drawable)},
     {"dri_get_rendering_buffer",
      offsetof (struct dri_vtable, get_rendering_buffer)},
     {"dri_swap_buffer",
      offsetof (struct dri_vtable, swap_buffer)},
     {NULL,}
+#endif
   };
 
   drv_ctx->dri_output =

src/media_drv_output_dri.h

@@ -30,7 +30,7 @@
 #define _MEDIA__DRIVER_OUT_DRI_H
 #include <stdbool.h>
 #include "media_drv_defines.h"
-#define LIBVA_X11_NAME "libva-x11.so.1"
+#define LIBVA_X11_NAME "libva-x11.so.2"
 VOID media_output_dri_terminate (VADriverContextP ctx);
 BOOL media_output_dri_init (VADriverContextP ctx);
 

src/vp9hdec/decode_hybrid_vp9.cpp

@@ -3289,9 +3289,16 @@ VAStatus Intel_HybridVp9Decode_HostVldRenderCb (
 
     // Reset padding flag of current frame and update surface dimension
     surface = SURFACE(pMdfDecodeFrame->ucCurrIndex);
+    if ((surface == NULL) || (surface->private_data == NULL))
+        return VA_STATUS_ERROR_INVALID_PARAMETER;
+
     pFrameSource = (INTEL_DECODE_HYBRID_VP9_MDF_FRAME_SOURCE *)(surface->private_data);
     pCurrFrame = &(pFrameSource->Frame);
     pFrameSource->bHasPadding = false;
+
+    if (pCurrFrame->pMdfSurface == NULL)
+        return VA_STATUS_ERROR_INVALID_PARAMETER;
+
     pCurrFrame->pMdfSurface->SetSurfaceStateDimensions(
         pMdfDecodeFrame->dwWidth,
         pMdfDecodeFrame->dwHeight);