From 5a173df1daa58d4d890877b75a81be5b02467830 Mon Sep 17 00:00:00 2001
From: "Antonino A. Daplas" <adaplas@gmail.com>
Date: Tue, 8 May 2007 00:39:19 -0700
Subject: [PATCH] --- yaml --- r: 54942 b: refs/heads/master c:
 38b4982c6388ae9596f959e3d7fef91affbd181d h: refs/heads/master v: v3

---
 [refs]                              |  2 +-
 trunk/drivers/video/console/fbcon.c | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index bd095e20fc17..fc2b81248ef5 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: ff388ad05bc67163124ac74126bbc16faa2fb771
+refs/heads/master: 38b4982c6388ae9596f959e3d7fef91affbd181d
diff --git a/trunk/drivers/video/console/fbcon.c b/trunk/drivers/video/console/fbcon.c
index c71a88d531cd..6fc3501581d6 100644
--- a/trunk/drivers/video/console/fbcon.c
+++ b/trunk/drivers/video/console/fbcon.c
@@ -685,6 +685,17 @@ static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
 		fbcon_set_bitops(ops);
 	}
 }
+
+static int fbcon_invalid_charcount(struct fb_info *info, unsigned charcount)
+{
+	int err = 0;
+
+	if (info->flags & FBINFO_MISC_TILEBLITTING &&
+	    info->tileops->fb_get_tilemax(info) < charcount)
+		err = 1;
+
+	return err;
+}
 #else
 static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
 {
@@ -695,6 +706,12 @@ static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
 	fbcon_set_rotation(info);
 	fbcon_set_bitops(ops);
 }
+
+static int fbcon_invalid_charcount(struct fb_info *info, unsigned charcount)
+{
+	return 0;
+}
+
 #endif /* CONFIG_MISC_TILEBLITTING */
 
 
@@ -2518,6 +2535,10 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne
 	    !(info->pixmap.blit_y & (1 << (font->height - 1))))
 		return -EINVAL;
 
+	/* Make sure driver can handle the font length */
+	if (fbcon_invalid_charcount(info, charcount))
+		return -EINVAL;
+
 	size = h * pitch * charcount;
 
 	new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);