diff options
| author | David S. Miller <davem@davemloft.net> | 2011-12-02 13:49:21 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-12-02 13:49:21 -0500 |
| commit | b3613118eb30a589d971e4eccbbb2a1314f5dfd4 (patch) | |
| tree | 868c1ee59e1b5c19a4f2e43716400d0001a994e5 /drivers/gpu/drm/drm_crtc.c | |
| parent | 7505afe28c16a8d386624930a018d0052c75d687 (diff) | |
| parent | 5983fe2b29df5885880d7fa3b91aca306c7564ef (diff) | |
| download | op-kernel-dev-b3613118eb30a589d971e4eccbbb2a1314f5dfd4.zip op-kernel-dev-b3613118eb30a589d971e4eccbbb2a1314f5dfd4.tar.gz | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Diffstat (limited to 'drivers/gpu/drm/drm_crtc.c')
| -rw-r--r-- | drivers/gpu/drm/drm_crtc.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index 405c63b..8323fc3 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -1873,6 +1873,10 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev, } if (num_clips && clips_ptr) { + if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) { + ret = -EINVAL; + goto out_err1; + } clips = kzalloc(num_clips * sizeof(*clips), GFP_KERNEL); if (!clips) { ret = -ENOMEM; |
