From 9b4aacc2100bce4e5a885c77db32db6703f05192 Mon Sep 17 00:00:00 2001
From: Alexander von Gluck IV <kallisti5@unixzen.com>
Date: Wed, 19 Oct 2011 18:40:46 +0000
Subject: [PATCH] * backport linux AtomBIOS parser bugfix...   Fixes memory
 corruption on some boards.

git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@42885 a95241bf-73f2-0310-859d-f6bbb57e9c96
---
 .../accelerants/radeon_hd/atombios/atom.cpp      | 16 +++++++++++++++-
 .../accelerants/radeon_hd/atombios/atom.h        |  1 +
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/add-ons/accelerants/radeon_hd/atombios/atom.cpp b/src/add-ons/accelerants/radeon_hd/atombios/atom.cpp
index 04fe4e4245..5649e545eb 100644
--- a/src/add-ons/accelerants/radeon_hd/atombios/atom.cpp
+++ b/src/add-ons/accelerants/radeon_hd/atombios/atom.cpp
@@ -246,6 +246,13 @@ atom_get_src_int(atom_exec_context *ctx, uint8 attr, int *ptr,
 			idx = U8(*ptr);
 			(*ptr)++;
 			val = gctx->scratch[((gctx->fb_base + idx) / 4)];
+			if ((gctx->fb_base + (idx * 4)) > gctx->scratch_size_bytes) {
+				ERROR("%s: fb tried to read beyond scratch region!"
+					" %" B_PRIu32 " vs. %d\n", __func__,
+					gctx->fb_base + (idx * 4), gctx->scratch_size_bytes);
+				val = 0;
+			} else
+				val = gctx->scratch[(gctx->fb_base / 4) + idx];
 			break;
 		case ATOM_ARG_IMM:
 			switch(align) {
@@ -463,7 +470,12 @@ atom_put_dst(atom_exec_context *ctx, int arg, uint8 attr,
 		case ATOM_ARG_FB:
 			idx = U8(*ptr);
 			(*ptr)++;
-			gctx->scratch[((gctx->fb_base + idx) / 4)] = val;
+			if ((gctx->fb_base + (idx * 4)) > gctx->scratch_size_bytes) {
+				ERROR("%s: fb tried to write beyond scratch region! "
+					"%" B_PRIu32 " vs. %d\n", __func__,
+					gctx->fb_base + (idx * 4), gctx->scratch_size_bytes);
+			} else
+				gctx->scratch[(gctx->fb_base / 4) + idx] = val;
 			break;
 		case ATOM_ARG_PLL:
 			idx = U8(*ptr);
@@ -1364,6 +1376,7 @@ atom_allocate_fb_scratch(atom_context *ctx)
 		usage_bytes
 			= firmware->asFirmwareVramReserveInfo[0].usFirmwareUseInKb * 1024;
 	}
+	ctx->scratch_size_bytes = 0;
 	if (usage_bytes == 0)
 		usage_bytes = 20 * 1024;
 	/* allocate some scratch memory */
@@ -1371,5 +1384,6 @@ atom_allocate_fb_scratch(atom_context *ctx)
 	if (!ctx->scratch)
 		return B_NO_MEMORY;
 
+	ctx->scratch_size_bytes = usage_bytes;
 	return B_OK;
 }
diff --git a/src/add-ons/accelerants/radeon_hd/atombios/atom.h b/src/add-ons/accelerants/radeon_hd/atombios/atom.h
index c0f7fec688..6ad02878c5 100644
--- a/src/add-ons/accelerants/radeon_hd/atombios/atom.h
+++ b/src/add-ons/accelerants/radeon_hd/atombios/atom.h
@@ -143,6 +143,7 @@ typedef struct atom_context_s {
 	int cs_equal, cs_above;
 	int io_mode;
 	uint32 *scratch;
+	int scratch_size_bytes;
 } atom_context;
 
 extern int atom_debug;