[Xorg-commit] xc/programs/Xserver/hw/xfree86/os-support/shared/drm/kernel r128_state.c,1.1.4.2,1.1.4.3

[Kaleb Keithley]

Committed by: kaleb

Update of /cvs/xorg/xc/programs/Xserver/hw/xfree86/os-support/shared/drm/kernel
In directory pdx:/home/kaleb/xorg/xc.XORG-CURRENT/programs/Xserver/hw/xfree86/os-support/shared/drm/kernel

Modified Files:
      Tag: XORG-CURRENT
	r128_state.c 
Log Message:
merge most of XFree86 RC3 (4.3.99.903) from vendor branch.
bug #214


Index: r128_state.c
===================================================================
RCS file: /cvs/xorg/xc/programs/Xserver/hw/xfree86/os-support/shared/drm/kernel/r128_state.c,v
retrieving revision 1.1.4.2
retrieving revision 1.1.4.3
diff -u -d -r1.1.4.2 -r1.1.4.3
--- a/r128_state.c	6 Dec 2003 13:24:28 -0000	1.1.4.2
+++ b/r128_state.c	23 Feb 2004 21:37:07 -0000	1.1.4.3
@@ -24,8 +24,20 @@
  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  * DEALINGS IN THE SOFTWARE.
  *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * RED HAT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * THIS SOFTWARE IS NOT INTENDED FOR USE IN SAFETY CRITICAL SYSTEMS
+ *
  * Authors:
  *    Gareth Hughes <gareth at valinux.com>
+ *
+ * Memory allocation size checks added 14/01/2003, Alan Cox <alan at redhat.com>
  */
 
 #include "r128.h"
@@ -916,6 +928,10 @@
 	DRM_DEBUG( "\n" );
 
 	count = depth->n;
+
+	if ( count > 4096 )
+		return DRM_ERR(EMSGSIZE);
+
 	if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) {
 		return DRM_ERR(EFAULT);
 	}
@@ -1010,6 +1026,9 @@
 
 	count = depth->n;
 
+	if ( count > 4096 )
+		return DRM_ERR(EMSGSIZE);
+
 	xbuf_size = count * sizeof(*x);
 	ybuf_size = count * sizeof(*y);
 	x = DRM_MALLOC( xbuf_size );
@@ -1126,6 +1145,10 @@
 	DRM_DEBUG( "\n" );
 
 	count = depth->n;
+
+	if ( count > 4096 )
+		return DRM_ERR(EMSGSIZE);
+
 	if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) {
 		return DRM_ERR(EFAULT);
 	}