Comment 22 for bug 889068

        dst = 0xa41ee000 <Address 0xa41ee000 out of bounds>

Failing in this chunk of code in intel_uxa.c:

                char *dst = priv->bo->virtual;
                int row_length = w * cpp;
                int num_rows = h;
                if (row_length == src_pitch && src_pitch == stride)
                        num_rows = 1, row_length *= h;
                dst += y * stride + x * cpp;
                do {
                        memcpy (dst, src, row_length);
                        src += src_pitch;
                        dst += stride;
                } while (--num_rows);

I've been able to reproduce an X server crash (rather, an EQ overflow) by loading a large (20M) image into eog, but so far haven't been able to get the reporter's same backtrace.