diff options
| author | Robert Watson <rwatson@FreeBSD.org> | 2004-02-23 05:19:46 +0000 |
|---|---|---|
| committer | Robert Watson <rwatson@FreeBSD.org> | 2004-02-23 05:19:46 +0000 |
| commit | b0b747558275ad0632981329836fa3776aeb1d86 (patch) | |
| tree | d267cfa1158e9c32df775bb5a17ce040ed8d186e /sys/dev/drm | |
| parent | 7b05829164120912fdcf8e1d0e370f4fc358a24d (diff) | |
Notes
Diffstat (limited to 'sys/dev/drm')
| -rw-r--r-- | sys/dev/drm/r128_state.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/sys/dev/drm/r128_state.c b/sys/dev/drm/r128_state.c index 9481d3c8831d..5a97ac0cd6c0 100644 --- a/sys/dev/drm/r128_state.c +++ b/sys/dev/drm/r128_state.c @@ -917,6 +917,9 @@ static int r128_cce_dispatch_write_span( drm_device_t *dev, DRM_DEBUG( "\n" ); count = depth->n; + if ( count > 4096 || count <= 0 ) { + return DRM_ERR(EMSGSIZE); + } if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) { return DRM_ERR(EFAULT); } @@ -1010,9 +1013,16 @@ static int r128_cce_dispatch_write_pixels( drm_device_t *dev, DRM_DEBUG( "\n" ); count = depth->n; + if ( count > 4096 || count <= 0 ) { + return DRM_ERR(EMSGSIZE); + } xbuf_size = count * sizeof(*x); ybuf_size = count * sizeof(*y); + if ( xbuf_size <= 0 || ybuf_size <= 0 ) { + return DRM_ERR(EMSGSIZE); + } + x = DRM_MALLOC( xbuf_size ); if ( x == NULL ) { return DRM_ERR(ENOMEM); @@ -1127,6 +1137,10 @@ static int r128_cce_dispatch_read_span( drm_device_t *dev, DRM_DEBUG( "\n" ); count = depth->n; + + if ( count > 4096 || count <= 0 ) { + return DRM_ERR(EMSGSIZE); + } if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) { return DRM_ERR(EFAULT); } @@ -1175,6 +1189,9 @@ static int r128_cce_dispatch_read_pixels( drm_device_t *dev, xbuf_size = count * sizeof(*x); ybuf_size = count * sizeof(*y); + if ( xbuf_size <= 0 || ybuf_size <= 0 ) { + return DRM_ERR(EMSGSIZE); + } x = DRM_MALLOC( xbuf_size ); if ( x == NULL ) { return DRM_ERR(ENOMEM); |