patch-2.4.27 linux-2.4.27/drivers/video/fbmem.c

• Lines: 71
• Date: 2004-08-07 16:26:05.819394647 -0700
• Orig file: linux-2.4.26/drivers/video/fbmem.c
• Orig date: 2004-02-18 05:36:31.000000000 -0800

diff -urN linux-2.4.26/drivers/video/fbmem.c linux-2.4.27/drivers/video/fbmem.c
@@ -404,7 +404,7 @@
 static ssize_t
 fb_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 {
-	unsigned long p = *ppos;
+	loff_t p = *ppos;
 	struct inode *inode = file->f_dentry->d_inode;
 	int fbidx = GET_FB_IDX(inode->i_rdev);
 	struct fb_info *info = registered_fb[fbidx];
@@ -414,12 +414,13 @@
 	if (! fb || ! info->disp)
 		return -ENODEV;
 
+	if (p < 0)
+		return -EINVAL;
+
 	fb->fb_get_fix(&fix,PROC_CONSOLE(info), info);
 	if (p >= fix.smem_len)
 	    return 0;
-	if (count >= fix.smem_len)
-	    count = fix.smem_len;
-	if (count + p > fix.smem_len)
+	if (count > fix.smem_len - p)
 		count = fix.smem_len - p;
 	if (count) {
 	    char *base_addr;
@@ -428,7 +429,7 @@
 	    count -= copy_to_user(buf, base_addr+p, count);
 	    if (!count)
 		return -EFAULT;
-	    *ppos += count;
+	    *ppos = p + count;
 	}
 	return count;
 }
@@ -436,7 +437,7 @@
 static ssize_t
 fb_write(struct file *file, const char *buf, size_t count, loff_t *ppos)
 {
-	unsigned long p = *ppos;
+	loff_t p = *ppos;
 	struct inode *inode = file->f_dentry->d_inode;
 	int fbidx = GET_FB_IDX(inode->i_rdev);
 	struct fb_info *info = registered_fb[fbidx];
@@ -447,13 +448,14 @@
 	if (! fb || ! info->disp)
 		return -ENODEV;
 
+	if (p < 0)
+		return -EINVAL;
+
 	fb->fb_get_fix(&fix, PROC_CONSOLE(info), info);
 	if (p > fix.smem_len)
 	    return -ENOSPC;
-	if (count >= fix.smem_len)
-	    count = fix.smem_len;
 	err = 0;
-	if (count + p > fix.smem_len) {
+	if (count > fix.smem_len - p) {
 	    count = fix.smem_len - p;
 	    err = -ENOSPC;
 	}
@@ -462,7 +464,7 @@
 
 	    base_addr = info->disp->screen_base;
 	    count -= copy_from_user(base_addr+p, buf, count);
-	    *ppos += count;
+	    *ppos = p + count;
 	    err = -EFAULT;
 	}
 	if (count)