⬢ DragonFlyBSD Kernel Audit
DF-3764 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
--- a/sys/dev/drm/radeon/r100.c
+++ b/sys/dev/drm/radeon/r100.c
@@ -1950,6 +1950,10 @@
 		break;
 	case 0x23:
 		/* 3D_RNDR_GEN_INDX_PRIM on r100/r200 */
+		if (pkt->count < 3) {
+			DRM_ERROR("Malformed 3D_RNDR_GEN_INDX_PRIM packet\n");
+			return -EINVAL;
+		}
 		r = radeon_cs_packet_next_reloc(p, &reloc, 0);
 		if (r) {
 			DRM_ERROR("No reloc for packet3 %d\n", pkt->opcode);
@@ -1972,6 +1976,10 @@
 			return r;
 		break;
 	case PACKET3_3D_DRAW_IMMD:
+		if (pkt->count < 1) {
+			DRM_ERROR("Malformed DRAW_IMMD packet\n");
+			return -EINVAL;
+		}
 		if (((radeon_get_ib_value(p, idx + 1) >> 4) & 0x3) != 3) {
 			DRM_ERROR("PRIM_WALK must be 3 for IMMD draw\n");
 			return -EINVAL;
@@ -2011,6 +2019,10 @@
 		break;
 		/* triggers drawing using indices to vertex buffer */
 	case PACKET3_3D_DRAW_VBUF:
+		if (pkt->count < 1) {
+			DRM_ERROR("Malformed DRAW_VBUF packet\n");
+			return -EINVAL;
+		}
 		track->vap_vf_cntl = radeon_get_ib_value(p, idx + 1);
 		r = r100_cs_track_check(p->rdev, track);
 		if (r)
@@ -2018,6 +2030,10 @@
 		break;
 		/* triggers drawing of vertex buffers setup elsewhere */
 	case PACKET3_3D_DRAW_INDX:
+		if (pkt->count < 1) {
+			DRM_ERROR("Malformed DRAW_INDX packet\n");
+			return -EINVAL;
+		}
 		track->vap_vf_cntl = radeon_get_ib_value(p, idx + 1);
 		r = r100_cs_track_check(p->rdev, track);
 		if (r)