From 4b58a10cc8b93acf9b0bd505ae07ecf3d19072d4 Mon Sep 17 00:00:00 2001 From: Xi Wang Date: Mon, 23 Apr 2012 04:06:41 -0400 Subject: [PATCH] --- yaml --- r: 299739 b: refs/heads/master c: ed8cd3b2cd61004cab85380c52b1817aca1ca49b h: refs/heads/master i: 299737: 2bdad8d93a7ce47ed699ce9d12355b99e14ec941 299735: c5e4002d4698ad9aebd5f0c31db650d20120ce63 v: v3 --- [refs] | 2 +- trunk/drivers/gpu/drm/i915/i915_gem_execbuffer.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/[refs] b/[refs] index 6e12f5ae8245..0062297cb40a 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: e95c8438ea1c56c254f0607c8fb6bca7f463c744 +refs/heads/master: ed8cd3b2cd61004cab85380c52b1817aca1ca49b diff --git a/trunk/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/trunk/drivers/gpu/drm/i915/i915_gem_execbuffer.c index f51a696486cb..7c50e58175c0 100644 --- a/trunk/drivers/gpu/drm/i915/i915_gem_execbuffer.c +++ b/trunk/drivers/gpu/drm/i915/i915_gem_execbuffer.c @@ -1404,7 +1404,8 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data, struct drm_i915_gem_exec_object2 *exec2_list = NULL; int ret; - if (args->buffer_count < 1) { + if (args->buffer_count < 1 || + args->buffer_count > UINT_MAX / sizeof(*exec2_list)) { DRM_DEBUG("execbuf2 with %d buffers\n", args->buffer_count); return -EINVAL; }