patch-2.4.26 linux-2.4.26/drivers/char/drm-4.0/r128_state.c

• Lines: 40
• Date: 2004-04-14 06:05:29.000000000 -0700
• Orig file: linux-2.4.25/drivers/char/drm-4.0/r128_state.c
• Orig date: 2002-02-25 11:37:57.000000000 -0800

diff -urN linux-2.4.25/drivers/char/drm-4.0/r128_state.c linux-2.4.26/drivers/char/drm-4.0/r128_state.c
@@ -938,6 +938,9 @@
 	}
 
 	count = depth->n;
+
+	if (count > 4096 || count <= 0)
+		return -EMSGSIZE;
 	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {
 		return -EFAULT;
 	}
@@ -1048,6 +1051,9 @@
 
 	count = depth->n;
 
+	if (count > 4096 || count <= 0)
+		return -EMSGSIZE;
+
 	x = kmalloc( count * sizeof(*x), 0 );
 	if ( x == NULL ) {
 		return -ENOMEM;
@@ -1178,6 +1184,10 @@
 	}
 
 	count = depth->n;
+	
+	if (count > 4096 || count <= 0)
+		return -EMSGSIZE;
+
 	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {
 		return -EFAULT;
 	}
@@ -1235,6 +1245,8 @@
 	}
 
 	count = depth->n;
+	if (count > 4096 || count <= 0)
+		return -EMSGSIZE;
 	if ( count > dev_priv->depth_pitch ) {
 		count = dev_priv->depth_pitch;
 	}