diff options
| author | Owain Ainsworth <oga@cvs.openbsd.org> | 2011-02-22 14:16:39 +0000 |
|---|---|---|
| committer | Owain Ainsworth <oga@cvs.openbsd.org> | 2011-02-22 14:16:39 +0000 |
| commit | 849cced5cad5a5a8ac89b4d6f0245a6b4e015a6b (patch) | |
| tree | ba4f2205b74eea4090e0cf7bfa51a25ec019de6e /sys/dev | |
| parent | 70812baf944ac0f9bca46406db6034c109b97d65 (diff) | |
In drm_modeset_ctl make sure to check the (now signed) value is > 0 as
well as < the array length.
ok kettenis@, mikeb@ (who suggested the same fix) and marco@.
"get that fixed" deraadt@.
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/pci/drm/drm_irq.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/dev/pci/drm/drm_irq.c b/sys/dev/pci/drm/drm_irq.c index 0c49c987cbd..c67d0912dbf 100644 --- a/sys/dev/pci/drm/drm_irq.c +++ b/sys/dev/pci/drm/drm_irq.c @@ -286,7 +286,7 @@ drm_modeset_ctl(struct drm_device *dev, void *data, struct drm_file *file_priv) return (0); crtc = modeset->crtc; - if (crtc >= dev->vblank->vb_num) + if (crtc >= dev->vblank->vb_num || crtc < 0) return (EINVAL); vbl = &dev->vblank->vb_crtcs[crtc]; |