drm/radeon: Read buffer overflow
authorRoel Kluin <roel.kluin@gmail.com>
Mon, 3 Aug 2009 12:20:32 +0000 (14:20 +0200)
committerDave Airlie <airlied@redhat.com>
Tue, 4 Aug 2009 03:41:05 +0000 (13:41 +1000)
Check whether index is within bounds before grabbing the element.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
drivers/gpu/drm/radeon/r100.c

index 05a44896dffb70ae4b3f328ad689db1aa8b3edf2..f1ba8ff4113063d2534a0bda2164faec0b8381d0 100644 (file)
@@ -722,13 +722,14 @@ int r100_cs_packet_parse(struct radeon_cs_parser *p,
                         unsigned idx)
 {
        struct radeon_cs_chunk *ib_chunk = &p->chunks[p->chunk_ib_idx];
-       uint32_t header = ib_chunk->kdata[idx];
+       uint32_t header;
 
        if (idx >= ib_chunk->length_dw) {
                DRM_ERROR("Can not parse packet at %d after CS end %d !\n",
                          idx, ib_chunk->length_dw);
                return -EINVAL;
        }
+       header = ib_chunk->kdata[idx];
        pkt->idx = idx;
        pkt->type = CP_PACKET_GET_TYPE(header);
        pkt->count = CP_PACKET_GET_COUNT(header);