patch-2.4.26 linux-2.4.26/drivers/char/drm/r128_state.c

• Lines: 37
• Date: 2004-04-14 06:05:29.000000000 -0700
• Orig file: linux-2.4.25/drivers/char/drm/r128_state.c
• Orig date: 2004-02-18 05:36:31.000000000 -0800

diff -urN linux-2.4.25/drivers/char/drm/r128_state.c linux-2.4.26/drivers/char/drm/r128_state.c
@@ -914,7 +914,7 @@
 
 	count = depth->n;
 	
-	if( count > 4096 )
+	if( count > 4096 || count <= 0)
 		return -EMSGSIZE;
 	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {
 		return -EFAULT;
@@ -1010,7 +1010,7 @@
 
 	count = depth->n;
 	
-	if( count > 4096 )
+	if( count > 4096 || count <= 0)
 		return -EMSGSIZE;
 
 	x = kmalloc( count * sizeof(*x), GFP_KERNEL );
@@ -1128,7 +1128,7 @@
 
 	count = depth->n;
 	
-	if ( count > 4096 )
+	if ( count > 4096 || count <= 0)
 		return -EMSGSIZE;
 	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {
 		return -EFAULT;
@@ -1172,6 +1172,9 @@
 	DRM_DEBUG( "%s\n", __FUNCTION__ );
 
 	count = depth->n;
+	if ( count > 4096 || count <= 0)
+		return -EMSGSIZE;
+
 	if ( count > dev_priv->depth_pitch ) {
 		count = dev_priv->depth_pitch;
 	}