summaryrefslogtreecommitdiff
path: root/sys
diff options
context:
space:
mode:
authorOwain Ainsworth <oga@cvs.openbsd.org>2008-08-13 20:45:43 +0000
committerOwain Ainsworth <oga@cvs.openbsd.org>2008-08-13 20:45:43 +0000
commit681835063789c939a99e367689f38cde91c0a697 (patch)
treecf44ced8b81da1d3b86d2208a87f95ea1673e4d4 /sys
parent89b68f105acd0230f440792304a56eabe4796c4e (diff)
Check for zero in drm_calloc() to prevent divide-by-zero. Also rearrange
the two calls to drm_calloc() that had nmemb and size the wrong way around.
Diffstat (limited to 'sys')
-rw-r--r--sys/dev/pci/drm/drm_drawable.c4
-rw-r--r--sys/dev/pci/drm/drm_memory.c2
-rw-r--r--sys/dev/pci/drm/drm_scatter.c2
3 files changed, 4 insertions, 4 deletions
diff --git a/sys/dev/pci/drm/drm_drawable.c b/sys/dev/pci/drm/drm_drawable.c
index 2c963d6ced1..06225dc6d2b 100644
--- a/sys/dev/pci/drm/drm_drawable.c
+++ b/sys/dev/pci/drm/drm_drawable.c
@@ -154,8 +154,8 @@ drm_update_draw(struct drm_device *dev, void *data, struct drm_file *file_priv)
return 0;
}
if (info->rects == NULL) {
- info->rects = drm_calloc(sizeof(*info->rects),
- update->num, DRM_MEM_DRAWABLE);
+ info->rects = drm_calloc(update->num,
+ sizeof(*info->rects), DRM_MEM_DRAWABLE);
if (info->rects == NULL) {
DRM_SPINUNLOCK(&dev->drw_lock);
return ENOMEM;
diff --git a/sys/dev/pci/drm/drm_memory.c b/sys/dev/pci/drm/drm_memory.c
index b613d27e1d6..769b853b6e7 100644
--- a/sys/dev/pci/drm/drm_memory.c
+++ b/sys/dev/pci/drm/drm_memory.c
@@ -57,7 +57,7 @@ drm_alloc(size_t size, int area)
void *
drm_calloc(size_t nmemb, size_t size, int area)
{
- if (SIZE_MAX / nmemb < size)
+ if (nmemb == 0 || SIZE_MAX / nmemb < size)
return (NULL);
else
return malloc(size * nmemb, M_DRM, M_NOWAIT | M_ZERO);
diff --git a/sys/dev/pci/drm/drm_scatter.c b/sys/dev/pci/drm/drm_scatter.c
index 6cccbeefc86..d0a2c0269ed 100644
--- a/sys/dev/pci/drm/drm_scatter.c
+++ b/sys/dev/pci/drm/drm_scatter.c
@@ -152,7 +152,7 @@ drm_sg_dmamem_alloc(struct drm_device *dev, size_t pages)
if (dsd == NULL)
return (NULL);
- dsd->sg_segs = drm_calloc(sizeof(*dsd->sg_segs), pages,
+ dsd->sg_segs = drm_calloc(pages, sizeof(*dsd->sg_segs),
DRM_MEM_SGLISTS);
if (dsd->sg_segs == NULL)
goto dsdfree;