patch-2.4.6 linux/drivers/char/drm/i810_dma.c

• Lines: 18
• Date: Wed Jun 27 17:10:55 2001
• Orig file: v2.4.5/linux/drivers/char/drm/i810_dma.c
• Orig date: Mon Mar 19 12:35:08 2001

diff -u --recursive --new-file v2.4.5/linux/drivers/char/drm/i810_dma.c linux/drivers/char/drm/i810_dma.c
@@ -1286,6 +1286,8 @@
 	DRM_DEBUG("i810 dma vertex, idx %d used %d discard %d\n",
 		  vertex.idx, vertex.used, vertex.discard);
 
+	if(vertex.idx < 0 || vertex.idx > dma->buf_count) return -EINVAL;
+
 	i810_dma_dispatch_vertex( dev, 
 				  dma->buflist[ vertex.idx ], 
 				  vertex.discard, vertex.used );
@@ -1409,7 +1411,7 @@
    	if (copy_from_user(&d, (drm_i810_copy_t *)arg, sizeof(d)))
 		return -EFAULT;
 
-	if(d.idx > dma->buf_count) return -EINVAL;
+	if(d.idx < 0 || d.idx > dma->buf_count) return -EINVAL;
 	buf = dma->buflist[ d.idx ];
    	buf_priv = buf->dev_private;
 	if (buf_priv->currently_mapped != I810_BUF_MAPPED) return -EPERM;