Re: [PATCH] drm/nouveau/nv04: check cursor buffer object size before upload

[lyude]

On Thu, 2026-08-13 at 18:35 +0800, Zhenhao Wan wrote:
>  struct drm_file *file_priv,
>  		return -ENOENT;
>  	cursor = nouveau_gem_object(gem);
>  
> +	if (gem->size < width * height * 4) {
> +		ret = -EINVAL;
> +		goto out;
> +	}
> +

A good start - but width and/or height could be UINT32_MAX, so a caller
could still overflow width or height. Would you mind adding an overflow
multiply check?

>  	ret = nouveau_bo_map(cursor);
>  	if (ret)
>  		goto out;
> 
> ---
> base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
> change-id: 20260813-nouveau-nv04-cursor-oob-ad2b6001de3d
> 
> Best regards,
> --  
> Zhenhao Wan <whi4ed0g@xxxxxxxxx>