xsrc/48569: radeon video playback may crash the X server

[martin%NetBSD.org@localhost]

>Number:         48569
>Category:       xsrc
>Synopsis:       radeon video playback may crash the X server
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    xsrc-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Feb 03 11:55:00 +0000 2014
>Originator:     Martin Husemann
>Release:        NetBSD 6.99.30
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD whoever-brings-the-night.aprisoft.de 6.99.30 NetBSD 6.99.30 
(WHOEVER) #106: Thu Jan 30 21:52:06 CET 2014 
martin%emmas.aprisoft.de@localhost:/usr/src/sys/arch/sparc64/compile/WHOEVER 
sparc64
Architecture: sparc64
Machine: sparc64
>Description:

On a sparc64 machine with XVR100 I am using gmplayer and xfce. When I move
the video playback window partly outside the screen, I can reproducably crash
the X server.

>How-To-Repeat:
s/a

>Fix:
Not sure if this is the best fix, but it works for me.

Index: radeon_accel.c
===================================================================
RCS file: /cvsroot/xsrc/external/mit/xf86-video-ati/dist/src/radeon_accel.c,v
retrieving revision 1.1.1.7
diff -u -r1.1.1.7 radeon_accel.c
--- radeon_accel.c      23 Sep 2012 19:49:26 -0000      1.1.1.7
+++ radeon_accel.c      3 Feb 2014 10:51:00 -0000
@@ -960,7 +960,30 @@
            return;
         }
     case RADEON_HOST_DATA_SWAP_32BIT:
-        {
+       if (((uintptr_t)dst & 1) || ((uintptr_t)src & 1)) {
+           uint8_t *d = (uint8_t *)dst;
+           uint8_t *s = (uint8_t *)src;
+           unsigned int nwords = size >> 2;
+
+           for (; nwords > 0; --nwords, d+=4, s+=4) {
+               d[0] = s[3];
+               d[1] = s[2];
+               d[2] = s[1];
+               d[3] = s[0];
+           }
+           return;
+        } else if (((uintptr_t)dst & 3) || ((uintptr_t)src & 3)) {
+           /* copy 16bit wise */
+           uint16_t *d = (uint16_t *)dst;
+           uint16_t *s = (uint16_t *)src;
+           unsigned int nwords = size >> 2;
+
+           for (; nwords > 0; --nwords, d+=2, s+=2) {
+               d[0] = ((s[1] >> 8) & 0xff) | ((s[1] & 0xff) << 8);
+               d[1] = ((s[0] >> 8) & 0xff) | ((s[0] & 0xff) << 8);
+           }
+           return;
+       } else {
            unsigned int *d = (unsigned int *)dst;
            unsigned int *s = (unsigned int *)src;
            unsigned int nwords = size >> 2;