summaryrefslogtreecommitdiff
path: root/shared/via_verifier.c
diff options
context:
space:
mode:
Diffstat (limited to 'shared/via_verifier.c')
-rw-r--r--shared/via_verifier.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/shared/via_verifier.c b/shared/via_verifier.c
index ada28929..edc9decd 100644
--- a/shared/via_verifier.c
+++ b/shared/via_verifier.c
@@ -497,6 +497,7 @@ static __inline__ int
via_check_prim_list(uint32_t const **buffer, const uint32_t *buf_end,
drm_via_state_t *cur_seq)
{
+ drm_via_private_t *dev_priv = (drm_via_private_t *) cur_seq->dev->dev_private;
uint32_t a_fire, bcmd , dw_count;
int ret = 0;
int have_fire;
@@ -541,6 +542,12 @@ via_check_prim_list(uint32_t const **buffer, const uint32_t *buf_end,
while(buf < buf_end) {
if (*buf == a_fire) {
+ if (dev_priv->num_fire_offsets >= VIA_FIRE_BUF_SIZE) {
+ DRM_ERROR("Fire offset buffer full.\n");
+ ret = 1;
+ break;
+ }
+ dev_priv->fire_offsets[dev_priv->num_fire_offsets++] = buf;
have_fire = 1;
buf++;
if (buf < buf_end && *buf == a_fire)
@@ -828,6 +835,7 @@ via_verify_command_stream(const uint32_t * buf, unsigned int size, drm_device_t
hc_state->map_cache = NULL;
hc_state->agp = agp;
hc_state->buf_start = buf;
+ dev_priv->num_fire_offsets = 0;
while (buf < buf_end) {