⬢ DragonFlyBSD Kernel Audit
DF-3763 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/drm/radeon/r100.c
+++ b/sys/dev/drm/radeon/r100.c
@@ -2141,6 +2141,11 @@
 
 	for (face = 0; face < 5; face++) {
 		cube_robj = track->textures[idx].cube_info[face].robj;
+		if (cube_robj == NULL) {
+			DRM_ERROR("Cube face %u of unit %u has no buffer bound\n",
+				  face, idx);
+			return -EINVAL;
+		}
 		w = track->textures[idx].cube_info[face].width;
 		h = track->textures[idx].cube_info[face].height;