patch-2.4.6 linux/drivers/char/drm/i810_dma.c

Next file: linux/drivers/char/drm/mga_state.c
Previous file: linux/drivers/char/drm/ffb_drv.c
Back to the patch index
Back to the overall index

diff -u --recursive --new-file v2.4.5/linux/drivers/char/drm/i810_dma.c linux/drivers/char/drm/i810_dma.c
@@ -1286,6 +1286,8 @@
 	DRM_DEBUG("i810 dma vertex, idx %d used %d discard %d\n",
 		  vertex.idx, vertex.used, vertex.discard);
 
+	if(vertex.idx < 0 || vertex.idx > dma->buf_count) return -EINVAL;
+
 	i810_dma_dispatch_vertex( dev, 
 				  dma->buflist[ vertex.idx ], 
 				  vertex.discard, vertex.used );
@@ -1409,7 +1411,7 @@
    	if (copy_from_user(&d, (drm_i810_copy_t *)arg, sizeof(d)))
 		return -EFAULT;
 
-	if(d.idx > dma->buf_count) return -EINVAL;
+	if(d.idx < 0 || d.idx > dma->buf_count) return -EINVAL;
 	buf = dma->buflist[ d.idx ];
    	buf_priv = buf->dev_private;
 	if (buf_priv->currently_mapped != I810_BUF_MAPPED) return -EPERM;

FUNET's LINUX-ADM group, linux-adm@nic.funet.fi
TCL-scripts by Sam Shen (who was at: slshen@lbl.gov)