diff options
| author | Jeff Hartmann <jhartmann@valinux.com> | 2001-07-16 16:57:12 +0000 |
|---|---|---|
| committer | Jeff Hartmann <jhartmann@valinux.com> | 2001-07-16 16:57:12 +0000 |
| commit | b816802daf6818306473c35d8776202c69fd0083 (patch) | |
| tree | fa2ef75579f8edd5a89eee4986890510544be81c | |
| parent | 7ccc528911137156f216a13c95ce946c5f65af15 (diff) | |
i810 drm security fix
| -rw-r--r-- | linux-core/i810_dma.c | 2 | ||||
| -rw-r--r-- | linux/i810_dma.c | 2 |
2 files changed, 4 insertions, 0 deletions
diff --git a/linux-core/i810_dma.c b/linux-core/i810_dma.c index 8abf80ad..75be5d0c 100644 --- a/linux-core/i810_dma.c +++ b/linux-core/i810_dma.c @@ -1229,6 +1229,8 @@ int i810_copybuf(struct inode *inode, struct file *filp, unsigned int cmd, buf_priv = buf->dev_private; if (buf_priv->currently_mapped != I810_BUF_MAPPED) return -EPERM; + if(d.used < 0 || d.used > buf->total) return -EINVAL; + if (copy_from_user(buf_priv->virtual, d.address, d.used)) return -EFAULT; diff --git a/linux/i810_dma.c b/linux/i810_dma.c index 8abf80ad..75be5d0c 100644 --- a/linux/i810_dma.c +++ b/linux/i810_dma.c @@ -1229,6 +1229,8 @@ int i810_copybuf(struct inode *inode, struct file *filp, unsigned int cmd, buf_priv = buf->dev_private; if (buf_priv->currently_mapped != I810_BUF_MAPPED) return -EPERM; + if(d.used < 0 || d.used > buf->total) return -EINVAL; + if (copy_from_user(buf_priv->virtual, d.address, d.used)) return -EFAULT; |