| commit | 6587eb82617f7913c13e750e73e13fa9c829863c | [log] [tgz] |
|---|---|---|
| author | Xi Wang <xi.wang@gmail.com> | Fri Apr 06 17:38:24 2012 -0400 |
| committer | Dave Airlie <airlied@redhat.com> | Tue Apr 10 10:22:51 2012 +0100 |
| tree | 47795de3efba773e42336c954b8f15675c156536 | |
| parent | 4de833c337509916b7931982734d858191cf0700 [diff] |
drm/savage: fix integer overflows in savage_bci_cmdbuf() Since cmdbuf->size and cmdbuf->nbox are from userspace, a large value would overflow the allocation size, leading to out-of-bounds access. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>