diff options
| -rw-r--r-- | linux-core/i810_dma.c | 2 | ||||
| -rw-r--r-- | linux/i810_dma.c | 2 |
2 files changed, 4 insertions, 0 deletions
diff --git a/linux-core/i810_dma.c b/linux-core/i810_dma.c index 8abf80ad..75be5d0c 100644 --- a/linux-core/i810_dma.c +++ b/linux-core/i810_dma.c @@ -1229,6 +1229,8 @@ int i810_copybuf(struct inode *inode, struct file *filp, unsigned int cmd, buf_priv = buf->dev_private; if (buf_priv->currently_mapped != I810_BUF_MAPPED) return -EPERM; + if(d.used < 0 || d.used > buf->total) return -EINVAL; + if (copy_from_user(buf_priv->virtual, d.address, d.used)) return -EFAULT; diff --git a/linux/i810_dma.c b/linux/i810_dma.c index 8abf80ad..75be5d0c 100644 --- a/linux/i810_dma.c +++ b/linux/i810_dma.c @@ -1229,6 +1229,8 @@ int i810_copybuf(struct inode *inode, struct file *filp, unsigned int cmd, buf_priv = buf->dev_private; if (buf_priv->currently_mapped != I810_BUF_MAPPED) return -EPERM; + if(d.used < 0 || d.used > buf->total) return -EINVAL; + if (copy_from_user(buf_priv->virtual, d.address, d.used)) return -EFAULT; |