diff options
| author | Pauli Nieminen <suokkos@gmail.com> | 2009-08-21 21:21:16 +0300 |
|---|---|---|
| committer | Pauli Nieminen <suokkos@gmail.com> | 2009-08-21 22:37:13 +0300 |
| commit | 90647ff5585ffb1417190e28f88bf1aeed681793 (patch) | |
| tree | 23ec4e224653de6bedc14aec7ca581662d6c3ff3 /src/mesa | |
| parent | b7ec2ebe33608f9107ff7cae6b974edc8097cecd (diff) | |
radeon: protect against buffer overflow in state atom debug code.
Diffstat (limited to 'src/mesa')
| -rw-r--r-- | src/mesa/drivers/dri/radeon/radeon_common.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/mesa/drivers/dri/radeon/radeon_common.c b/src/mesa/drivers/dri/radeon/radeon_common.c index 4088ef303c..30d24574ed 100644 --- a/src/mesa/drivers/dri/radeon/radeon_common.c +++ b/src/mesa/drivers/dri/radeon/radeon_common.c @@ -904,6 +904,9 @@ static void radeon_print_state_atom_prekmm(radeonContextPtr radeon, struct radeo fprintf(stderr, " emit %s %d/%d\n", state->name, dwords, state->cmd_size); if (RADEON_DEBUG & DEBUG_VERBOSE) { + if (dwords > state->cmd_size) + dwords = state->cmd_size; + for (i = 0; i < dwords;) { cmd = *((drm_r300_cmd_header_t *) &state->cmd[i]); reg = (cmd.packet0.reghi << 8) | cmd.packet0.reglo; @@ -938,6 +941,8 @@ static void radeon_print_state_atom(radeonContextPtr radeon, struct radeon_state fprintf(stderr, " emit %s %d/%d\n", state->name, dwords, state->cmd_size); if (RADEON_DEBUG & DEBUG_VERBOSE) { + if (dwords > state->cmd_size) + dwords = state->cmd_size; for (i = 0; i < state->cmd_size;) { packet0 = state->cmd[i]; reg = (packet0 & 0x1FFF) << 2; |