From fa99239cb73dbf419bea9f334b85ba94ac88a532 Mon Sep 17 00:00:00 2001 From: Roel Kluin Date: Mon, 3 Aug 2009 14:20:32 +0200 Subject: drm/radeon: Read buffer overflow Check whether index is within bounds before grabbing the element. Signed-off-by: Roel Kluin Signed-off-by: Dave Airlie --- drivers/gpu/drm/radeon/r100.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c index 05a44896dff..f1ba8ff4113 100644 --- a/drivers/gpu/drm/radeon/r100.c +++ b/drivers/gpu/drm/radeon/r100.c @@ -722,13 +722,14 @@ int r100_cs_packet_parse(struct radeon_cs_parser *p, unsigned idx) { struct radeon_cs_chunk *ib_chunk = &p->chunks[p->chunk_ib_idx]; - uint32_t header = ib_chunk->kdata[idx]; + uint32_t header; if (idx >= ib_chunk->length_dw) { DRM_ERROR("Can not parse packet at %d after CS end %d !\n", idx, ib_chunk->length_dw); return -EINVAL; } + header = ib_chunk->kdata[idx]; pkt->idx = idx; pkt->type = CP_PACKET_GET_TYPE(header); pkt->count = CP_PACKET_GET_COUNT(header); -- cgit v1.2.3-18-g5258