aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorRoel Kluin <roel.kluin@gmail.com>2009-08-03 08:20:32 -0400
committerDave Airlie <airlied@redhat.com>2009-08-03 23:41:05 -0400
commitfa99239cb73dbf419bea9f334b85ba94ac88a532 (patch)
treeea955f6d162a45ba098d9cc247f92e9a7ddada10 /drivers
parentfee280d3fd9bc5247bef9f4ab35a4693bfffdcfd (diff)
drm/radeon: Read buffer overflow
Check whether index is within bounds before grabbing the element. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/gpu/drm/radeon/r100.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 05a44896dffb..f1ba8ff41130 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -722,13 +722,14 @@ int r100_cs_packet_parse(struct radeon_cs_parser *p,
722 unsigned idx) 722 unsigned idx)
723{ 723{
724 struct radeon_cs_chunk *ib_chunk = &p->chunks[p->chunk_ib_idx]; 724 struct radeon_cs_chunk *ib_chunk = &p->chunks[p->chunk_ib_idx];
725 uint32_t header = ib_chunk->kdata[idx]; 725 uint32_t header;
726 726
727 if (idx >= ib_chunk->length_dw) { 727 if (idx >= ib_chunk->length_dw) {
728 DRM_ERROR("Can not parse packet at %d after CS end %d !\n", 728 DRM_ERROR("Can not parse packet at %d after CS end %d !\n",
729 idx, ib_chunk->length_dw); 729 idx, ib_chunk->length_dw);
730 return -EINVAL; 730 return -EINVAL;
731 } 731 }
732 header = ib_chunk->kdata[idx];
732 pkt->idx = idx; 733 pkt->idx = idx;
733 pkt->type = CP_PACKET_GET_TYPE(header); 734 pkt->type = CP_PACKET_GET_TYPE(header);
734 pkt->count = CP_PACKET_GET_COUNT(header); 735 pkt->count = CP_PACKET_GET_COUNT(header);