summaryrefslogtreecommitdiff
path: root/src/mesa
diff options
context:
space:
mode:
authorPauli Nieminen <suokkos@gmail.com>2009-08-21 21:21:16 +0300
committerPauli Nieminen <suokkos@gmail.com>2009-08-21 22:37:13 +0300
commit90647ff5585ffb1417190e28f88bf1aeed681793 (patch)
tree23ec4e224653de6bedc14aec7ca581662d6c3ff3 /src/mesa
parentb7ec2ebe33608f9107ff7cae6b974edc8097cecd (diff)
radeon: protect against buffer overflow in state atom debug code.
Diffstat (limited to 'src/mesa')
-rw-r--r--src/mesa/drivers/dri/radeon/radeon_common.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/src/mesa/drivers/dri/radeon/radeon_common.c b/src/mesa/drivers/dri/radeon/radeon_common.c
index 4088ef303c..30d24574ed 100644
--- a/src/mesa/drivers/dri/radeon/radeon_common.c
+++ b/src/mesa/drivers/dri/radeon/radeon_common.c
@@ -904,6 +904,9 @@ static void radeon_print_state_atom_prekmm(radeonContextPtr radeon, struct radeo
fprintf(stderr, " emit %s %d/%d\n", state->name, dwords, state->cmd_size);
if (RADEON_DEBUG & DEBUG_VERBOSE) {
+ if (dwords > state->cmd_size)
+ dwords = state->cmd_size;
+
for (i = 0; i < dwords;) {
cmd = *((drm_r300_cmd_header_t *) &state->cmd[i]);
reg = (cmd.packet0.reghi << 8) | cmd.packet0.reglo;
@@ -938,6 +941,8 @@ static void radeon_print_state_atom(radeonContextPtr radeon, struct radeon_state
fprintf(stderr, " emit %s %d/%d\n", state->name, dwords, state->cmd_size);
if (RADEON_DEBUG & DEBUG_VERBOSE) {
+ if (dwords > state->cmd_size)
+ dwords = state->cmd_size;
for (i = 0; i < state->cmd_size;) {
packet0 = state->cmd[i];
reg = (packet0 & 0x1FFF) << 2;