summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--linux-core/i810_dma.c2
-rw-r--r--linux/i810_dma.c2
2 files changed, 4 insertions, 0 deletions
diff --git a/linux-core/i810_dma.c b/linux-core/i810_dma.c
index 8abf80ad..75be5d0c 100644
--- a/linux-core/i810_dma.c
+++ b/linux-core/i810_dma.c
@@ -1229,6 +1229,8 @@ int i810_copybuf(struct inode *inode, struct file *filp, unsigned int cmd,
buf_priv = buf->dev_private;
if (buf_priv->currently_mapped != I810_BUF_MAPPED) return -EPERM;
+ if(d.used < 0 || d.used > buf->total) return -EINVAL;
+
if (copy_from_user(buf_priv->virtual, d.address, d.used))
return -EFAULT;
diff --git a/linux/i810_dma.c b/linux/i810_dma.c
index 8abf80ad..75be5d0c 100644
--- a/linux/i810_dma.c
+++ b/linux/i810_dma.c
@@ -1229,6 +1229,8 @@ int i810_copybuf(struct inode *inode, struct file *filp, unsigned int cmd,
buf_priv = buf->dev_private;
if (buf_priv->currently_mapped != I810_BUF_MAPPED) return -EPERM;
+ if(d.used < 0 || d.used > buf->total) return -EINVAL;
+
if (copy_from_user(buf_priv->virtual, d.address, d.used))
return -EFAULT;