DragonFlyBSD Kernel Audit
DF-2055 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/drm_gem_framebuffer_helper.c b/sys/dev/drm/drm_gem_framebuffer_helper.c
--- a/sys/dev/drm/drm_gem_framebuffer_helper.c
+++ b/sys/dev/drm/drm_gem_framebuffer_helper.c
@@ -154,11 +154,14 @@
 	struct drm_framebuffer *fb;
 	int ret, i;
 
-	info = drm_get_format_info(dev, mode_cmd);
-	if (!info)
-		return ERR_PTR(-EINVAL);
-
-	for (i = 0; i < info->num_planes; i++) {
+	info = drm_get_format_info(dev, mode_cmd);
+	if (!info)
+		return ERR_PTR(-EINVAL);
+
+	if (mode_cmd->width == 0 || mode_cmd->height == 0)
+		return ERR_PTR(-EINVAL);
+
+	for (i = 0; i < info->num_planes; i++) {
 		unsigned int width = mode_cmd->width / (i ? info->hsub : 1);
 		unsigned int height = mode_cmd->height / (i ? info->vsub : 1);
 		unsigned int min_size;