DragonFlyBSD Kernel Audit
DF-1748 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/radeon/radeon_gem.c b/sys/dev/drm/radeon/radeon_gem.c
--- a/sys/dev/drm/radeon/radeon_gem.c
+++ b/sys/dev/drm/radeon/radeon_gem.c
@@ -763,8 +763,10 @@
 
 	args->pitch = radeon_align_pitch(rdev, args->width,
 					 DIV_ROUND_UP(args->bpp, 8), 0);
-	args->size = args->pitch * args->height;
+	args->size = (uint64_t)args->pitch * args->height;
 	args->size = ALIGN(args->size, PAGE_SIZE);
+	if (args->size == 0)
+		return -EINVAL;
 
 	r = radeon_gem_object_create(rdev, args->size, 0,
 				     RADEON_GEM_DOMAIN_VRAM, 0,