luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

drm/radeon: Read buffer overflow

Browse Source 
Check whether index is within bounds before grabbing the element.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This commit is contained in:
Roel Kluin 2009-08-03 14:20:32 +02:00 committed by Dave Airlie
parent fee280d3fd
commit fa99239cb7
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/gpu/drm/radeon/r100.c
View File

@ -722,13 +722,14 @@ int r100_cs_packet_parse(struct radeon_cs_parser *p,
unsigned idx) unsigned idx)
{ {
struct radeon_cs_chunk *ib_chunk = &p->chunks[p->chunk_ib_idx]; struct radeon_cs_chunk *ib_chunk = &p->chunks[p->chunk_ib_idx];
uint32_t header = ib_chunk->kdata[idx]; uint32_t header;
if (idx >= ib_chunk->length_dw) { if (idx >= ib_chunk->length_dw) {
DRM_ERROR("Can not parse packet at %d after CS end %d !\n", DRM_ERROR("Can not parse packet at %d after CS end %d !\n",
idx, ib_chunk->length_dw); idx, ib_chunk->length_dw);
return -EINVAL; return -EINVAL;
} }
header = ib_chunk->kdata[idx];
pkt->idx = idx; pkt->idx = idx;
pkt->type = CP_PACKET_GET_TYPE(header); pkt->type = CP_PACKET_GET_TYPE(header);
pkt->count = CP_PACKET_GET_COUNT(header); pkt->count = CP_PACKET_GET_COUNT(header);