diff options
| author | Dave Airlie <airlied@linux.ie> | 2004-04-08 12:05:25 +0000 |
|---|---|---|
| committer | Dave Airlie <airlied@linux.ie> | 2004-04-08 12:05:25 +0000 |
| commit | bc1428035ceb5300df429d09a64a20a2a7e903b2 (patch) | |
| tree | bc49b454b6b8e144fc6722badeafd4a295a46d18 /shared-core/r128_state.c | |
| parent | ee2889ec0d2f8b6138f916df3c3d8b7e208cc1f7 (diff) | |
fixes from Linux kernel
Diffstat (limited to 'shared-core/r128_state.c')
| -rw-r--r-- | shared-core/r128_state.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/shared-core/r128_state.c b/shared-core/r128_state.c index f411657f..dcacb0f3 100644 --- a/shared-core/r128_state.c +++ b/shared-core/r128_state.c @@ -915,6 +915,9 @@ static int r128_cce_dispatch_write_span( drm_device_t *dev, DRM_DEBUG( "\n" ); count = depth->n; + if (count>4096 || count<=0) + return -EMSGSIZE; + if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) { return DRM_ERR(EFAULT); } @@ -1008,6 +1011,8 @@ static int r128_cce_dispatch_write_pixels( drm_device_t *dev, DRM_DEBUG( "\n" ); count = depth->n; + if (count > 4096 || count <= 0) + return -EMSGSIZE; xbuf_size = count * sizeof(*x); ybuf_size = count * sizeof(*y); @@ -1125,6 +1130,9 @@ static int r128_cce_dispatch_read_span( drm_device_t *dev, DRM_DEBUG( "\n" ); count = depth->n; + if (count > 4096 || count <= 0) + return -EMSGSIZE; + if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) { return DRM_ERR(EFAULT); } @@ -1167,6 +1175,9 @@ static int r128_cce_dispatch_read_pixels( drm_device_t *dev, DRM_DEBUG( "%s\n", __FUNCTION__ ); count = depth->n; + if (count > 4096 || count <= 0) + return -EMSGSIZE; + if ( count > dev_priv->depth_pitch ) { count = dev_priv->depth_pitch; } |