⬢ DragonFlyBSD Kernel Audit
DF-3766 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/drm/radeon/r100.c
+++ b/sys/dev/drm/radeon/r100.c
@@ -1907,7 +1907,7 @@
 	u32 value;
 	idx = pkt->idx + 1;
 	value = radeon_get_ib_value(p, idx + 2);
-	if ((value + 1) > radeon_bo_size(robj)) {
+	if (value >= radeon_bo_size(robj)) {
 		DRM_ERROR("[drm] Buffer too small for PACKET3 INDX_BUFFER "
 			  "(need %u have %lu) !\n",
 			  value + 1,