Check for multiplication overflow in drm_calloc(). ok oga@

diff --git a/sys/dev/pci/drm/drm_memory.c b/sys/dev/pci/drm/drm_memory.c
index 44714ca..8d99963 100644 (file)
--- a/sys/dev/pci/drm/drm_memory.c
+++ b/sys/dev/pci/drm/drm_memory.c
@@ -57,8 +57,10 @@ drm_alloc(size_t size, int area)
 void *
 drm_calloc(size_t nmemb, size_t size, int area)
 {
-       /* XXX overflow checking */
-       return malloc(size * nmemb, M_DRM, M_NOWAIT | M_ZERO);
+       if (SIZE_MAX / nmemb < size)
+               return (NULL);
+       else
+               return malloc(size * nmemb, M_DRM, M_NOWAIT | M_ZERO);
 }
 
 void *