From dc4defe742387dc3081557111b67a1ab99455dbb Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Mon, 7 Feb 2005 22:55:54 +0000 Subject: Invalid bound check of driver defined ioctls in drm_ioctl Bug 2489 Reporter: Aapo Tahkola --- linux-core/drm_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'linux-core/drm_drv.c') diff --git a/linux-core/drm_drv.c b/linux-core/drm_drv.c index 60020bb9..884cc3fa 100644 --- a/linux-core/drm_drv.c +++ b/linux-core/drm_drv.c @@ -588,7 +588,7 @@ int drm_ioctl(struct inode *inode, struct file *filp, if (nr < DRIVER_IOCTL_COUNT) ioctl = &drm_ioctls[nr]; else if ((nr >= DRM_COMMAND_BASE) - || (nr < DRM_COMMAND_BASE + dev->driver->num_ioctls)) + && (nr < DRM_COMMAND_BASE + dev->driver->num_ioctls)) ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE]; else goto err_i1; -- cgit v1.2.3