From 383684596c83b2da475e96c0de18e481c1432718 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Corentin=20No=C3=ABl?= <corentin.noel@collabora.com>
Date: Wed, 21 May 2025 12:05:00 +0200
Subject: [PATCH] llvmpipe: Check for negative size before mapping the memory

CID: 1596479 Argument cannot be negative
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/35091>
---
 src/gallium/drivers/llvmpipe/lp_texture.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/gallium/drivers/llvmpipe/lp_texture.c b/src/gallium/drivers/llvmpipe/lp_texture.c
index 9f99e61a69e..b54a999c252 100644
--- a/src/gallium/drivers/llvmpipe/lp_texture.c
+++ b/src/gallium/drivers/llvmpipe/lp_texture.c
@@ -1491,6 +1491,12 @@ llvmpipe_import_memory_fd(struct pipe_screen *screen,
 #if defined(HAVE_LIBDRM) && defined(HAVE_LINUX_UDMABUF_H)
    if (dmabuf) {
       off_t mmap_size = lseek(fd, 0, SEEK_END);
+      if (mmap_size < 0) {
+         free(alloc);
+         *ptr = NULL;
+         return false;
+      }
+
       lseek(fd, 0, SEEK_SET);
       void *cpu_addr = mmap(0, mmap_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
       if (cpu_addr == MAP_FAILED) {