|
Lines 23-30
Link Here
|
| 23 |
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER |
23 |
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER |
| 24 |
* DEALINGS IN THE SOFTWARE. |
24 |
* DEALINGS IN THE SOFTWARE. |
| 25 |
* |
25 |
* |
|
|
26 |
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
| 27 |
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
| 28 |
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL |
| 29 |
* RED HAT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR |
| 30 |
* OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, |
| 31 |
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER |
| 32 |
* DEALINGS IN THE SOFTWARE. |
| 33 |
* |
| 34 |
* THIS SOFTWARE IS NOT INTENDED FOR USE IN SAFETY CRITICAL SYSTEMS |
| 35 |
* |
| 26 |
* Authors: |
36 |
* Authors: |
| 27 |
* Gareth Hughes <gareth@valinux.com> |
37 |
* Gareth Hughes <gareth@valinux.com> |
|
|
38 |
* |
| 39 |
* Memory allocation size checks added 14/01/2003, Alan Cox <alan@redhat.com> |
| 28 |
*/ |
40 |
*/ |
| 29 |
|
41 |
|
| 30 |
#include "r128.h" |
42 |
#include "r128.h" |
|
Lines 901-906
Link Here
|
| 901 |
DRM_DEBUG( "%s\n", __FUNCTION__ ); |
913 |
DRM_DEBUG( "%s\n", __FUNCTION__ ); |
| 902 |
|
914 |
|
| 903 |
count = depth->n; |
915 |
count = depth->n; |
|
|
916 |
|
| 917 |
if( count > 4096 ) |
| 918 |
return -EMSGSIZE; |
| 904 |
if ( copy_from_user( &x, depth->x, sizeof(x) ) ) { |
919 |
if ( copy_from_user( &x, depth->x, sizeof(x) ) ) { |
| 905 |
return -EFAULT; |
920 |
return -EFAULT; |
| 906 |
} |
921 |
} |
|
Lines 994-999
Link Here
|
| 994 |
DRM_DEBUG( "%s\n", __FUNCTION__ ); |
1009 |
DRM_DEBUG( "%s\n", __FUNCTION__ ); |
| 995 |
|
1010 |
|
| 996 |
count = depth->n; |
1011 |
count = depth->n; |
|
|
1012 |
|
| 1013 |
if( count > 4096 ) |
| 1014 |
return -EMSGSIZE; |
| 997 |
|
1015 |
|
| 998 |
x = kmalloc( count * sizeof(*x), GFP_KERNEL ); |
1016 |
x = kmalloc( count * sizeof(*x), GFP_KERNEL ); |
| 999 |
if ( x == NULL ) { |
1017 |
if ( x == NULL ) { |
|
Lines 1109-1114
Link Here
|
| 1109 |
DRM_DEBUG( "%s\n", __FUNCTION__ ); |
1127 |
DRM_DEBUG( "%s\n", __FUNCTION__ ); |
| 1110 |
|
1128 |
|
| 1111 |
count = depth->n; |
1129 |
count = depth->n; |
|
|
1130 |
|
| 1131 |
if ( count > 4096 ) |
| 1132 |
return -EMSGSIZE; |
| 1112 |
if ( copy_from_user( &x, depth->x, sizeof(x) ) ) { |
1133 |
if ( copy_from_user( &x, depth->x, sizeof(x) ) ) { |
| 1113 |
return -EFAULT; |
1134 |
return -EFAULT; |
| 1114 |
} |
1135 |
} |