summaryrefslogtreecommitdiff
path: root/shared/r128_state.c
diff options
context:
space:
mode:
Diffstat (limited to 'shared/r128_state.c')
-rw-r--r--shared/r128_state.c11
1 files changed, 11 insertions, 0 deletions
diff --git a/shared/r128_state.c b/shared/r128_state.c
index f411657f..dcacb0f3 100644
--- a/shared/r128_state.c
+++ b/shared/r128_state.c
@@ -915,6 +915,9 @@ static int r128_cce_dispatch_write_span( drm_device_t *dev,
DRM_DEBUG( "\n" );
count = depth->n;
+ if (count>4096 || count<=0)
+ return -EMSGSIZE;
+
if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) {
return DRM_ERR(EFAULT);
}
@@ -1008,6 +1011,8 @@ static int r128_cce_dispatch_write_pixels( drm_device_t *dev,
DRM_DEBUG( "\n" );
count = depth->n;
+ if (count > 4096 || count <= 0)
+ return -EMSGSIZE;
xbuf_size = count * sizeof(*x);
ybuf_size = count * sizeof(*y);
@@ -1125,6 +1130,9 @@ static int r128_cce_dispatch_read_span( drm_device_t *dev,
DRM_DEBUG( "\n" );
count = depth->n;
+ if (count > 4096 || count <= 0)
+ return -EMSGSIZE;
+
if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) {
return DRM_ERR(EFAULT);
}
@@ -1167,6 +1175,9 @@ static int r128_cce_dispatch_read_pixels( drm_device_t *dev,
DRM_DEBUG( "%s\n", __FUNCTION__ );
count = depth->n;
+ if (count > 4096 || count <= 0)
+ return -EMSGSIZE;
+
if ( count > dev_priv->depth_pitch ) {
count = dev_priv->depth_pitch;
}