diff options
| author | Dave Airlie <airlied@redhat.com> | 2012-05-07 16:09:09 +0100 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2012-05-07 16:09:35 +0100 |
| commit | 4f256e8aa3eda15c11c3cec3ec5336e1fc579cbd (patch) | |
| tree | 33c02b5e18e79756005a3edfa7c862a47de668d5 /drivers/gpu/drm/i915/i915_gem_execbuffer.c | |
| parent | 4086b1e2b19729eebf632073b9d4ab811726d8eb (diff) | |
| parent | dc257cf154be708ecc47b8b89c12ad8cd2cc35e4 (diff) | |
| download | olio-linux-3.10-4f256e8aa3eda15c11c3cec3ec5336e1fc579cbd.tar.xz olio-linux-3.10-4f256e8aa3eda15c11c3cec3ec5336e1fc579cbd.zip | |
Merge branch 'for-airlied' of git://people.freedesktop.org/~danvet/drm-intel into drm-core-next
Daniel prepared this branch with a back-merge as git was getting
very confused about changes in intel_display.c
Diffstat (limited to 'drivers/gpu/drm/i915/i915_gem_execbuffer.c')
| -rw-r--r-- | drivers/gpu/drm/i915/i915_gem_execbuffer.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c index 68ec0130a62..c77bfa9ad34 100644 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c @@ -1116,6 +1116,11 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, return -EINVAL; } + if (args->num_cliprects > UINT_MAX / sizeof(*cliprects)) { + DRM_DEBUG("execbuf with %u cliprects\n", + args->num_cliprects); + return -EINVAL; + } cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects), GFP_KERNEL); if (cliprects == NULL) { @@ -1387,7 +1392,8 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data, struct drm_i915_gem_exec_object2 *exec2_list = NULL; int ret; - if (args->buffer_count < 1) { + if (args->buffer_count < 1 || + args->buffer_count > UINT_MAX / sizeof(*exec2_list)) { DRM_DEBUG("execbuf2 with %d buffers\n", args->buffer_count); return -EINVAL; } |