PATCH: 2.6.7-rc3 drivers/video/fbmem.c: user/kernel pointer bugs

["Robert T. Johnson" <rtjohnso@eecs.berkeley.edu>]

Since sprite is a user pointer, reading sprite->mask or sprite->image.data 
requires unsafe dereferences.  Let me know if you have any questions or if 
I've made a mistake.

Best,
Rob

--- linux-2.6.7-rc3-full/drivers/video/fbmem.c.orig	Wed Jun  9 13:09:30 2004
+++ linux-2.6.7-rc3-full/drivers/video/fbmem.c	Wed Jun  9 13:07:06 2004
@@ -901,7 +901,9 @@ fb_cursor(struct fb_info *info, struct f
 {
 	struct fb_cursor cursor;
 	int err;
-	
+	char *mask;
+	const char *image_data;
+
 	if (copy_from_user(&cursor, sprite, sizeof(struct fb_cursor)))
 		return -EFAULT;
 
@@ -920,18 +922,20 @@ fb_cursor(struct fb_info *info, struct f
 		    (cursor.image.width != info->cursor.image.width))
 			cursor.set |= FB_CUR_SETSIZE;
 		
+		image_data = cursor.image.data;
 		cursor.image.data = kmalloc(size, GFP_KERNEL);
 		if (!cursor.image.data)
 			return -ENOMEM;
 		
+		mask = cursor.mask;
 		cursor.mask = kmalloc(size, GFP_KERNEL);
 		if (!cursor.mask) {
 			kfree(cursor.image.data);
 			return -ENOMEM;
 		}
 		
-		if (copy_from_user(cursor.image.data, sprite->image.data, size) ||
-		    copy_from_user(cursor.mask, sprite->mask, size)) { 
+		if (copy_from_user(cursor.image.data, image_data, size) ||
+		    copy_from_user(cursor.mask, mask, size)) { 
 			kfree(cursor.image.data);
 			kfree(cursor.mask);
 			return -EFAULT;