diff options
| -rw-r--r-- | shared-core/r128_state.c | 11 | ||||
| -rw-r--r-- | shared-core/radeon_state.c | 15 | ||||
| -rw-r--r-- | shared/r128_state.c | 11 | ||||
| -rw-r--r-- | shared/radeon_state.c | 15 |
4 files changed, 48 insertions, 4 deletions
diff --git a/shared-core/r128_state.c b/shared-core/r128_state.c index f411657f..dcacb0f3 100644 --- a/shared-core/r128_state.c +++ b/shared-core/r128_state.c @@ -915,6 +915,9 @@ static int r128_cce_dispatch_write_span( drm_device_t *dev, DRM_DEBUG( "\n" ); count = depth->n; + if (count>4096 || count<=0) + return -EMSGSIZE; + if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) { return DRM_ERR(EFAULT); } @@ -1008,6 +1011,8 @@ static int r128_cce_dispatch_write_pixels( drm_device_t *dev, DRM_DEBUG( "\n" ); count = depth->n; + if (count > 4096 || count <= 0) + return -EMSGSIZE; xbuf_size = count * sizeof(*x); ybuf_size = count * sizeof(*y); @@ -1125,6 +1130,9 @@ static int r128_cce_dispatch_read_span( drm_device_t *dev, DRM_DEBUG( "\n" ); count = depth->n; + if (count > 4096 || count <= 0) + return -EMSGSIZE; + if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) { return DRM_ERR(EFAULT); } @@ -1167,6 +1175,9 @@ static int r128_cce_dispatch_read_pixels( drm_device_t *dev, DRM_DEBUG( "%s\n", __FUNCTION__ ); count = depth->n; + if (count > 4096 || count <= 0) + return -EMSGSIZE; + if ( count > dev_priv->depth_pitch ) { count = dev_priv->depth_pitch; } diff --git a/shared-core/radeon_state.c b/shared-core/radeon_state.c index 0ed1f53d..fca72827 100644 --- a/shared-core/radeon_state.c +++ b/shared-core/radeon_state.c @@ -1497,7 +1497,7 @@ static int radeon_cp_dispatch_texture( DRMFILE filp, /* Update the input parameters for next time */ image->y += height; image->height -= height; - (const u8 *)image->data += size; + image->data = (const u8 *)image->data + size; } while (image->height > 0); /* Flush the pixel cache after the blit completes. This ensures @@ -2485,10 +2485,21 @@ int radeon_cp_getparam( DRM_IOCTL_ARGS ) case RADEON_PARAM_STATUS_HANDLE: value = dev_priv->ring_rptr_offset; break; +#if BITS_PER_LONG == 32 + /* + * This ioctl() doesn't work on 64-bit platforms because hw_lock is a + * pointer which can't fit into an int-sized variable. According to + * Michel Dänzer, the ioctl() is only used on embedded platforms, so + * not supporting it shouldn't be a problem. If the same functionality + * is needed on 64-bit platforms, a new ioctl() would have to be added, + * so backwards-compatibility for the embedded platforms can be + * maintained. --davidm 4-Feb-2004. + */ case RADEON_PARAM_SAREA_HANDLE: /* The lock is the first dword in the sarea. */ - value = (int)dev->lock.hw_lock; + value = (long)dev->lock.hw_lock; break; +#endif case RADEON_PARAM_GART_TEX_HANDLE: value = dev_priv->gart_textures_offset; break; diff --git a/shared/r128_state.c b/shared/r128_state.c index f411657f..dcacb0f3 100644 --- a/shared/r128_state.c +++ b/shared/r128_state.c @@ -915,6 +915,9 @@ static int r128_cce_dispatch_write_span( drm_device_t *dev, DRM_DEBUG( "\n" ); count = depth->n; + if (count>4096 || count<=0) + return -EMSGSIZE; + if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) { return DRM_ERR(EFAULT); } @@ -1008,6 +1011,8 @@ static int r128_cce_dispatch_write_pixels( drm_device_t *dev, DRM_DEBUG( "\n" ); count = depth->n; + if (count > 4096 || count <= 0) + return -EMSGSIZE; xbuf_size = count * sizeof(*x); ybuf_size = count * sizeof(*y); @@ -1125,6 +1130,9 @@ static int r128_cce_dispatch_read_span( drm_device_t *dev, DRM_DEBUG( "\n" ); count = depth->n; + if (count > 4096 || count <= 0) + return -EMSGSIZE; + if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) { return DRM_ERR(EFAULT); } @@ -1167,6 +1175,9 @@ static int r128_cce_dispatch_read_pixels( drm_device_t *dev, DRM_DEBUG( "%s\n", __FUNCTION__ ); count = depth->n; + if (count > 4096 || count <= 0) + return -EMSGSIZE; + if ( count > dev_priv->depth_pitch ) { count = dev_priv->depth_pitch; } diff --git a/shared/radeon_state.c b/shared/radeon_state.c index 0ed1f53d..fca72827 100644 --- a/shared/radeon_state.c +++ b/shared/radeon_state.c @@ -1497,7 +1497,7 @@ static int radeon_cp_dispatch_texture( DRMFILE filp, /* Update the input parameters for next time */ image->y += height; image->height -= height; - (const u8 *)image->data += size; + image->data = (const u8 *)image->data + size; } while (image->height > 0); /* Flush the pixel cache after the blit completes. This ensures @@ -2485,10 +2485,21 @@ int radeon_cp_getparam( DRM_IOCTL_ARGS ) case RADEON_PARAM_STATUS_HANDLE: value = dev_priv->ring_rptr_offset; break; +#if BITS_PER_LONG == 32 + /* + * This ioctl() doesn't work on 64-bit platforms because hw_lock is a + * pointer which can't fit into an int-sized variable. According to + * Michel Dänzer, the ioctl() is only used on embedded platforms, so + * not supporting it shouldn't be a problem. If the same functionality + * is needed on 64-bit platforms, a new ioctl() would have to be added, + * so backwards-compatibility for the embedded platforms can be + * maintained. --davidm 4-Feb-2004. + */ case RADEON_PARAM_SAREA_HANDLE: /* The lock is the first dword in the sarea. */ - value = (int)dev->lock.hw_lock; + value = (long)dev->lock.hw_lock; break; +#endif case RADEON_PARAM_GART_TEX_HANDLE: value = dev_priv->gart_textures_offset; break; |