Bug 2489

Summary:	Invalid bound check of driver defined ioctls in drm_ioctl
Product:	DRI	Reporter:	Aapo Tahkola <aet>
Component:	DRM/other	Assignee:	Default DRI bug account <dri-devel>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	high
Version:	unspecified
Hardware:	x86 (IA32)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:

Description Aapo Tahkola 2005-02-07 13:00:48 UTC

--- drm_drv.c~	Mon Dec 13 11:17:28 2004
+++ drm_drv.c	Mon Dec 13 11:15:41 2004
@@ -595,7 +595,7 @@
 	if (nr < DRIVER_IOCTL_COUNT)
 		ioctl = &drm_ioctls[nr];
 	else if ((nr >= DRM_COMMAND_BASE)
-		 || (nr < DRM_COMMAND_BASE + dev->driver->num_ioctls))
+		 && (nr < DRM_COMMAND_BASE + dev->driver->num_ioctls))
 		ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
 	else
 		goto err_i1;

Comment 1 Dave Airlie 2005-02-07 14:56:17 UTC

committed...

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.