From: oga <oga@openbsd.org>
Date: Wed, 13 Aug 2008 20:45:42 +0000 (+0000)
Subject: Check for zero in drm_calloc() to prevent divide-by-zero. Also rearrange
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=30eb576afd886949bc2691e3174cf37227bd8bb4;p=openbsd

Check for zero in drm_calloc() to prevent divide-by-zero. Also rearrange
the two calls to drm_calloc() that had nmemb and size the wrong way
around.
---

diff --git a/sys/dev/pci/drm/drm_drawable.c b/sys/dev/pci/drm/drm_drawable.c
index 2c963d6ced1..06225dc6d2b 100644
--- a/sys/dev/pci/drm/drm_drawable.c
+++ b/sys/dev/pci/drm/drm_drawable.c
@@ -154,8 +154,8 @@ drm_update_draw(struct drm_device *dev, void *data, struct drm_file *file_priv)
 			return 0;
 		}
 		if (info->rects == NULL) {
-			info->rects = drm_calloc(sizeof(*info->rects),
-			    update->num, DRM_MEM_DRAWABLE);
+			info->rects = drm_calloc(update->num,
+			    sizeof(*info->rects), DRM_MEM_DRAWABLE);
 			if (info->rects == NULL) {
 				DRM_SPINUNLOCK(&dev->drw_lock);
 				return ENOMEM;
diff --git a/sys/dev/pci/drm/drm_memory.c b/sys/dev/pci/drm/drm_memory.c
index b613d27e1d6..769b853b6e7 100644
--- a/sys/dev/pci/drm/drm_memory.c
+++ b/sys/dev/pci/drm/drm_memory.c
@@ -57,7 +57,7 @@ drm_alloc(size_t size, int area)
 void *
 drm_calloc(size_t nmemb, size_t size, int area)
 {
-	if (SIZE_MAX / nmemb < size)
+	if (nmemb == 0 || SIZE_MAX / nmemb < size)
 		return (NULL);
 	else
 		return malloc(size * nmemb, M_DRM, M_NOWAIT | M_ZERO);
diff --git a/sys/dev/pci/drm/drm_scatter.c b/sys/dev/pci/drm/drm_scatter.c
index 6cccbeefc86..d0a2c0269ed 100644
--- a/sys/dev/pci/drm/drm_scatter.c
+++ b/sys/dev/pci/drm/drm_scatter.c
@@ -152,7 +152,7 @@ drm_sg_dmamem_alloc(struct drm_device *dev, size_t pages)
 	if (dsd == NULL)
 		return (NULL);
 
-	dsd->sg_segs = drm_calloc(sizeof(*dsd->sg_segs), pages,
+	dsd->sg_segs = drm_calloc(pages, sizeof(*dsd->sg_segs),
 	    DRM_MEM_SGLISTS);
 	if (dsd->sg_segs == NULL)
 		goto dsdfree;