From: Xi Wang <xi.wang@gmail.com>
Date: Fri, 6 Apr 2012 21:38:24 +0000 (-0400)
Subject: drm/savage: fix integer overflows in savage_bci_cmdbuf()
X-Git-Tag: v3.4-rc3~33^2~5
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6587eb82617f7913c13e750e73e13fa9c829863c;p=pandora-kernel.git

drm/savage: fix integer overflows in savage_bci_cmdbuf()

Since cmdbuf->size and cmdbuf->nbox are from userspace, a large value
would overflow the allocation size, leading to out-of-bounds access.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
---

Reading git-diff-tree failed