--- drivers/char/agp/generic.c

+++ drivers/char/agp/generic.c

@@ -123,6 +123,9 @@ static struct agp_memory *agp_create_use

struct agp_memory *new;

unsigned long alloc_size = num_agp_pages*sizeof(struct page *);

+ if (INT_MAX/sizeof(struct page *) < num_agp_pages)

+ return NULL;

+

new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);

if (new == NULL)

return NULL;

@@ -242,11 +245,14 @@ struct agp_memory *agp_allocate_memory(s

int scratch_pages;

struct agp_memory *new;

size_t i;

+ int cur_memory;

if (!bridge)

return NULL;

- if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)

+ cur_memory = atomic_read(&bridge->current_memory_agp);

+ if ((cur_memory + page_count > bridge->max_memory_agp) ||

+ (cur_memory + page_count < page_count))

return NULL;

if (type >= AGP_USER_TYPES) {

@@ -1123,8 +1129,8 @@ int agp_generic_insert_memory(struct agp

return -EINVAL;

}

- /* AK: could wrap */

- if ((pg_start + mem->page_count) > num_entries)

+ if (((pg_start + mem->page_count) > num_entries) ||

+ ((pg_start + mem->page_count) < pg_start))

return -EINVAL;

j = pg_start;

@@ -1158,7 +1164,7 @@ int agp_generic_remove_memory(struct agp

{

size_t i;

struct agp_bridge_data *bridge;

- int mask_type;

+ int mask_type, num_entries;

bridge = mem->bridge;

if (!bridge)

@@ -1170,6 +1176,11 @@ int agp_generic_remove_memory(struct agp

if (type != mem->type)

return -EINVAL;

+ num_entries = agp_num_entries();

+ if (((pg_start + mem->page_count) > num_entries) ||

+ ((pg_start + mem->page_count) < pg_start))

+ return -EINVAL;

+

mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);

if (mask_type != 0) {

/* The generic routines know nothing of memory types */