Attachment #25949 for bug #42024

Lines 25-30 Link Here

(-)linux/drivers/char/drm/r128_state.c (+11 lines)
25	*	25	*
26	* Authors:	26	* Authors:
27	* Gareth Hughes <gareth@valinux.com>	27	* Gareth Hughes <gareth@valinux.com>
		28	*
		29	* Memory allocation size checks added 14/01/2003, Alan Cox <alan@redhat.com>
28	*/	30	*/
29		31
30	#include "r128.h"	32	#include "r128.h"
Lines 901-906 Link Here
901	DRM_DEBUG( "%s\n", __FUNCTION__ );	903	DRM_DEBUG( "%s\n", __FUNCTION__ );
902		904
903	count = depth->n;	905	count = depth->n;
		906
		907	if( count > 4096 )
		908	return -EMSGSIZE;
904	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {	909	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {
905	return -EFAULT;	910	return -EFAULT;
906	}	911	}
Lines 995-1000 Link Here
995		1000
996	count = depth->n;	1001	count = depth->n;
997		1002
		1003	if( count > 4096 )
		1004	return -EMSGSIZE;
		1005
998	x = kmalloc( count * sizeof(*x), GFP_KERNEL );	1006	x = kmalloc( count * sizeof(*x), GFP_KERNEL );
999	if ( x == NULL ) {	1007	if ( x == NULL ) {
1000	return -ENOMEM;	1008	return -ENOMEM;
Lines 1109-1114 Link Here
1109	DRM_DEBUG( "%s\n", __FUNCTION__ );	1117	DRM_DEBUG( "%s\n", __FUNCTION__ );
1110		1118
1111	count = depth->n;	1119	count = depth->n;
		1120
		1121	if ( count > 4096 )
		1122	return -EMSGSIZE;
1112	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {	1123	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {
1113	return -EFAULT;	1124	return -EFAULT;
1114	}	1125	}

Lines 26-31 Link Here

(-)linux/drivers/char/drm-4.0/r128_state.c (+10 lines)
26	* Authors:	26	* Authors:
27	* Gareth Hughes <gareth@valinux.com>	27	* Gareth Hughes <gareth@valinux.com>
28	*	28	*
		29	* Memory allocation size checks added 14/01/2003, Alan Cox <alan@redhat.com>
29	*/	30	*/
30		31
31	#define __NO_VERSION__	32	#define __NO_VERSION__
Lines 938-943 Link Here
938	}	939	}
939		940
940	count = depth->n;	941	count = depth->n;
		942
		943	if( count > 4096 )
		944	return -EMSGSIZE;
941	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {	945	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {
942	return -EFAULT;	946	return -EFAULT;
943	}	947	}
Lines 1048-1053 Link Here
1048		1052
1049	count = depth->n;	1053	count = depth->n;
1050		1054
		1055	if( count > 4096 )
		1056	return -EMSGSIZE;
		1057
1051	x = kmalloc( count * sizeof(*x), 0 );	1058	x = kmalloc( count * sizeof(*x), 0 );
1052	if ( x == NULL ) {	1059	if ( x == NULL ) {
1053	return -ENOMEM;	1060	return -ENOMEM;
Lines 1178-1183 Link Here
1178	}	1185	}
1179		1186
1180	count = depth->n;	1187	count = depth->n;
		1188
		1189	if ( count > 4096 )
		1190	return -EMSGSIZE;
1181	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {	1191	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {
1182	return -EFAULT;	1192	return -EFAULT;
1183	}	1193	}

Return to bug 42024