From 30eb576afd886949bc2691e3174cf37227bd8bb4 Mon Sep 17 00:00:00 2001 From: oga Date: Wed, 13 Aug 2008 20:45:42 +0000 Subject: [PATCH] Check for zero in drm_calloc() to prevent divide-by-zero. Also rearrange the two calls to drm_calloc() that had nmemb and size the wrong way around. --- sys/dev/pci/drm/drm_drawable.c | 4 ++-- sys/dev/pci/drm/drm_memory.c | 2 +- sys/dev/pci/drm/drm_scatter.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/sys/dev/pci/drm/drm_drawable.c b/sys/dev/pci/drm/drm_drawable.c index 2c963d6ced1..06225dc6d2b 100644 --- a/sys/dev/pci/drm/drm_drawable.c +++ b/sys/dev/pci/drm/drm_drawable.c @@ -154,8 +154,8 @@ drm_update_draw(struct drm_device *dev, void *data, struct drm_file *file_priv) return 0; } if (info->rects == NULL) { - info->rects = drm_calloc(sizeof(*info->rects), - update->num, DRM_MEM_DRAWABLE); + info->rects = drm_calloc(update->num, + sizeof(*info->rects), DRM_MEM_DRAWABLE); if (info->rects == NULL) { DRM_SPINUNLOCK(&dev->drw_lock); return ENOMEM; diff --git a/sys/dev/pci/drm/drm_memory.c b/sys/dev/pci/drm/drm_memory.c index b613d27e1d6..769b853b6e7 100644 --- a/sys/dev/pci/drm/drm_memory.c +++ b/sys/dev/pci/drm/drm_memory.c @@ -57,7 +57,7 @@ drm_alloc(size_t size, int area) void * drm_calloc(size_t nmemb, size_t size, int area) { - if (SIZE_MAX / nmemb < size) + if (nmemb == 0 || SIZE_MAX / nmemb < size) return (NULL); else return malloc(size * nmemb, M_DRM, M_NOWAIT | M_ZERO); diff --git a/sys/dev/pci/drm/drm_scatter.c b/sys/dev/pci/drm/drm_scatter.c index 6cccbeefc86..d0a2c0269ed 100644 --- a/sys/dev/pci/drm/drm_scatter.c +++ b/sys/dev/pci/drm/drm_scatter.c @@ -152,7 +152,7 @@ drm_sg_dmamem_alloc(struct drm_device *dev, size_t pages) if (dsd == NULL) return (NULL); - dsd->sg_segs = drm_calloc(sizeof(*dsd->sg_segs), pages, + dsd->sg_segs = drm_calloc(pages, sizeof(*dsd->sg_segs), DRM_MEM_SGLISTS); if (dsd->sg_segs == NULL) goto dsdfree; -- 2.20.1