i810 drm security fix

diff --git a/linux-core/i810_dma.c b/linux-core/i810_dma.c
index 8abf80a..75be5d0 100644 (file)
--- a/linux-core/i810_dma.c
+++ b/linux-core/i810_dma.c
@@ -1229,6 +1229,8 @@ int i810_copybuf(struct inode *inode, struct file *filp, unsigned int cmd,
        buf_priv = buf->dev_private;
        if (buf_priv->currently_mapped != I810_BUF_MAPPED) return -EPERM;
 
+       if(d.used < 0 || d.used > buf->total) return -EINVAL;
+
        if (copy_from_user(buf_priv->virtual, d.address, d.used))
                return -EFAULT;
 

diff --git a/linux/i810_dma.c b/linux/i810_dma.c
index 8abf80a..75be5d0 100644 (file)
--- a/linux/i810_dma.c
+++ b/linux/i810_dma.c
@@ -1229,6 +1229,8 @@ int i810_copybuf(struct inode *inode, struct file *filp, unsigned int cmd,
        buf_priv = buf->dev_private;
        if (buf_priv->currently_mapped != I810_BUF_MAPPED) return -EPERM;
 
+       if(d.used < 0 || d.used > buf->total) return -EINVAL;
+
        if (copy_from_user(buf_priv->virtual, d.address, d.used))
                return -EFAULT;