|
Lines 23-30
Link Here
|
| 23 |
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER |
23 |
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER |
| 24 |
* DEALINGS IN THE SOFTWARE. |
24 |
* DEALINGS IN THE SOFTWARE. |
| 25 |
* |
25 |
* |
|
|
26 |
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
| 27 |
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
| 28 |
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL |
| 29 |
* RED HAT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR |
| 30 |
* OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, |
| 31 |
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER |
| 32 |
* DEALINGS IN THE SOFTWARE. |
| 33 |
* |
| 34 |
* THIS SOFTWARE IS NOT INTENDED FOR USE IN SAFETY CRITICAL SYSTEMS |
| 35 |
* |
| 26 |
* Authors: |
36 |
* Authors: |
| 27 |
* Gareth Hughes <gareth@valinux.com> |
37 |
* Gareth Hughes <gareth@valinux.com> |
|
|
38 |
* |
| 39 |
* Memory allocation size checks added 14/01/2003, Alan Cox <alan@redhat.com> |
| 40 |
* Memory allocation size checks enhanced 16/02/2004, Thomas Biege <thomas@suse.de> |
| 41 |
* |
| 28 |
*/ |
42 |
*/ |
| 29 |
|
43 |
|
| 30 |
#include "r128.h" |
44 |
#include "r128.h" |
|
Lines 902-907
static int r128_cce_dispatch_write_span(
Link Here
|
| 902 |
DRM_DEBUG( "%s\n", __FUNCTION__ ); |
916 |
DRM_DEBUG( "%s\n", __FUNCTION__ ); |
| 903 |
|
917 |
|
| 904 |
count = depth->n; |
918 |
count = depth->n; |
|
|
919 |
|
| 920 |
if( count > 4096 || count <= 0) |
| 921 |
return -EMSGSIZE; |
| 905 |
if ( copy_from_user( &x, depth->x, sizeof(x) ) ) { |
922 |
if ( copy_from_user( &x, depth->x, sizeof(x) ) ) { |
| 906 |
return -EFAULT; |
923 |
return -EFAULT; |
| 907 |
} |
924 |
} |
|
Lines 996-1001
static int r128_cce_dispatch_write_pixel
Link Here
|
| 996 |
|
1013 |
|
| 997 |
count = depth->n; |
1014 |
count = depth->n; |
| 998 |
|
1015 |
|
|
|
1016 |
if( count > 4096 || count <= 0) |
| 1017 |
return -EMSGSIZE; |
| 1018 |
|
| 999 |
x = kmalloc( count * sizeof(*x), GFP_KERNEL ); |
1019 |
x = kmalloc( count * sizeof(*x), GFP_KERNEL ); |
| 1000 |
if ( x == NULL ) { |
1020 |
if ( x == NULL ) { |
| 1001 |
return -ENOMEM; |
1021 |
return -ENOMEM; |
|
Lines 1110-1115
static int r128_cce_dispatch_read_span(
Link Here
|
| 1110 |
DRM_DEBUG( "%s\n", __FUNCTION__ ); |
1130 |
DRM_DEBUG( "%s\n", __FUNCTION__ ); |
| 1111 |
|
1131 |
|
| 1112 |
count = depth->n; |
1132 |
count = depth->n; |
|
|
1133 |
|
| 1134 |
if ( count > 4096 || count <= 0) |
| 1135 |
return -EMSGSIZE; |
| 1113 |
if ( copy_from_user( &x, depth->x, sizeof(x) ) ) { |
1136 |
if ( copy_from_user( &x, depth->x, sizeof(x) ) ) { |
| 1114 |
return -EFAULT; |
1137 |
return -EFAULT; |
| 1115 |
} |
1138 |
} |
|
Lines 1155-1161
static int r128_cce_dispatch_read_pixels
Link Here
|
| 1155 |
if ( count > dev_priv->depth_pitch ) { |
1178 |
if ( count > dev_priv->depth_pitch ) { |
| 1156 |
count = dev_priv->depth_pitch; |
1179 |
count = dev_priv->depth_pitch; |
| 1157 |
} |
1180 |
} |
|
|
1181 |
if( count * sizeof(int) <= 0 || count * sizeof(*x) <= 0 || count * sizeof(*y) <= 0) |
| 1182 |
return -EMSGSIZE; |
| 1158 |
|
1183 |
|
|
|
1184 |
|
| 1159 |
x = kmalloc( count * sizeof(*x), GFP_KERNEL ); |
1185 |
x = kmalloc( count * sizeof(*x), GFP_KERNEL ); |
| 1160 |
if ( x == NULL ) { |
1186 |
if ( x == NULL ) { |
| 1161 |
return -ENOMEM; |
1187 |
return -ENOMEM; |