patch-2.4.7 linux/drivers/char/drm/mga_bufs.c

• Lines: 33
• Date: Mon Jul 16 15:13:32 2001
• Orig file: v2.4.6/linux/drivers/char/drm/mga_bufs.c
• Orig date: Mon Mar 19 12:35:08 2001

diff -u --recursive --new-file v2.4.6/linux/drivers/char/drm/mga_bufs.c linux/drivers/char/drm/mga_bufs.c
@@ -97,7 +97,17 @@
 		atomic_dec(&dev->buf_alloc);
 		return -ENOMEM; /* May only call once for each order */
 	}
-   
+
+	/* This isnt neccessarily a good limit, but we have to stop a dumb
+	   32 bit overflow problem below */
+	   
+	if ( count < 0 || count > 4096)
+	{
+		up(&dev->struct_sem);
+		atomic_dec(&dev->buf_alloc);
+		return -EINVAL;
+	}
+		   
 	entry->buflist = drm_alloc(count * sizeof(*entry->buflist),
 				   DRM_MEM_BUFS);
 	if (!entry->buflist) {
@@ -248,6 +258,13 @@
 		up(&dev->struct_sem);
 		atomic_dec(&dev->buf_alloc);
 		return -ENOMEM;	/* May only call once for each order */
+	}
+	
+	if(count < 0 || count > 4096)
+	{
+		up(&dev->struct_sem);
+		atomic_dec(&dev->buf_alloc);
+		return -EINVAL;
 	}
 	
 	entry->buflist = drm_alloc(count * sizeof(*entry->buflist),