From: Andrea Arcangeli <andrea@suse.de>

Correctly range-check an incoming-from-userspace argument.  Found by the
Stanford checker.


---

 25-akpm/drivers/char/drm/i810_dma.c |    3 +++
 1 files changed, 3 insertions(+)

diff -puN drivers/char/drm/i810_dma.c~i810_dma-range-check drivers/char/drm/i810_dma.c
--- 25/drivers/char/drm/i810_dma.c~i810_dma-range-check	2004-04-20 19:09:50.584339256 -0700
+++ 25-akpm/drivers/char/drm/i810_dma.c	2004-04-20 19:09:50.589338496 -0700
@@ -1275,6 +1275,9 @@ int i810_dma_mc(struct inode *inode, str
 		return -EINVAL;
 	}
 
+	if (mc.idx >= dma->buf_count || mc.idx < 0)
+		return -EINVAL;
+
 	i810_dma_dispatch_mc(dev, dma->buflist[mc.idx], mc.used,
 		mc.last_render );
 

_