7217 Buffer overflow in i915 driver
Reviewed by: Dan McDonald <danmcd@omniti.com>
Reviewed by: Richard Lowe <richlowe@richlowe.net>
Reviewed by: Garrett D'Amore <garrett@damore.org>
Reviewed by: Toomas Soome <tsoome@me.com>

*** 38,47 ****
--- 38,51 ----
   * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
   * Use is subject to license terms.
   */
  
  /*
+  * Copyright 2014 RackTop Systems.
+  */
+ 
+ /*
   * I915 DRM Driver for Solaris
   *
   * This driver provides the hardware 3D acceleration support for Intel
   * integrated video devices (e.g. i8xx/i915/i945 series chipsets), under the
   * DRI (Direct Rendering Infrastructure). DRM (Direct Rendering Manager) here
*** 706,716 ****
          /* Memory arbitration state */
          S3_WRITE (MI_ARB_STATE, s3_priv->saveMI_ARB_STATE | 0xffff0000);
          
          for (i = 0; i < 16; i++) {
                  S3_WRITE(SWF0 + (i << 2), s3_priv->saveSWF0[i]);
!                 S3_WRITE(SWF10 + (i << 2), s3_priv->saveSWF1[i+7]);
          }
          for (i = 0; i < 3; i++)
                  S3_WRITE(SWF30 + (i << 2), s3_priv->saveSWF2[i]);
  
          S3_WRITE(I915REG_PGTBL_CTRL, s3_priv->pgtbl_ctl);
--- 710,720 ----
          /* Memory arbitration state */
          S3_WRITE (MI_ARB_STATE, s3_priv->saveMI_ARB_STATE | 0xffff0000);
          
          for (i = 0; i < 16; i++) {
                  S3_WRITE(SWF0 + (i << 2), s3_priv->saveSWF0[i]);
!                 S3_WRITE(SWF10 + (i << 2), s3_priv->saveSWF1[i]);
          }
          for (i = 0; i < 3; i++)
                  S3_WRITE(SWF30 + (i << 2), s3_priv->saveSWF2[i]);
  
          S3_WRITE(I915REG_PGTBL_CTRL, s3_priv->pgtbl_ctl);