Attachment 16029 Details for Bug 48945

[patch] drm4_r128_state.c.diff (drm4 subdirec)

drm4_r128_state.c.diff (text/plain), 1.30 KB, created by Thomas Biege on 2004-02-17 23:32:48 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2004-02-17 23:32:48 UTC

Size: 1.30 KB

patch

obsolete

>--- r128_state.c.bak	2004-02-16 15:40:14.000000000 +0100
>+++ r128_state.c	2004-02-16 17:38:03.000000000 +0100
>@@ -26,6 +26,8 @@
>  * Authors:
>  *    Gareth Hughes <gareth@valinux.com>
>  *
>+ * Memory allocation size checks added 16/02/2004, Thomas Biege <thomas@suse.de>
>+ *
>  */
> 
> #define __NO_VERSION__
>@@ -938,6 +940,9 @@ static int r128_cce_dispatch_write_span(
> 	}
> 
> 	count = depth->n;
>+
>+	if( count > 4096 || count <= 0)
>+		return -EMSGSIZE;
> 	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {
> 		return -EFAULT;
> 	}
>@@ -1047,6 +1052,9 @@ static int r128_cce_dispatch_write_pixel
> 	}
> 
> 	count = depth->n;
>+	if( count > 4096 || count <= 0 || count * sizeof(*x) <= 0 ||
>+	    count * sizeof(*y) <= 0)
>+		return -EMSGSIZE;	
> 
> 	x = kmalloc( count * sizeof(*x), 0 );
> 	if ( x == NULL ) {
>@@ -1178,6 +1186,9 @@ static int r128_cce_dispatch_read_span( 
> 	}
> 
> 	count = depth->n;
>+
>+	if ( count > 4096 || count <= 0)
>+		return -EMSGSIZE;
> 	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {
> 		return -EFAULT;
> 	}
>@@ -1238,6 +1249,8 @@ static int r128_cce_dispatch_read_pixels
> 	if ( count > dev_priv->depth_pitch ) {
> 		count = dev_priv->depth_pitch;
> 	}
>+	if( count * sizeof(int) <= 0 || count * sizeof(*x) <= 0 || count * sizeof(*y) <= 0)
>+		return -EMSGSIZE;
> 
> 	x = kmalloc( count * sizeof(*x), 0 );
> 	if ( x == NULL ) {

Actions: View | Diff

Attachments on bug 48945: 15651 | 16028 | 16029