Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6735e5723b5b4bc9bc0a24a841fbd0f2e7944b3f
Commit:     6735e5723b5b4bc9bc0a24a841fbd0f2e7944b3f
Parent:     28a0d9df0706c523d3bb8de18892c76b78c2e428
Author:     Takashi Iwai <[EMAIL PROTECTED]>
AuthorDate: Sat Jan 19 10:33:07 2008 +0100
Committer:  Jaroslav Kysela <[EMAIL PROTECTED]>
CommitDate: Thu Jan 31 17:30:05 2008 +0100

    [ALSA] emu10k1 - Fix over-sized kmalloc for TLV
    
    Reported by Al Viro:
    In copy_tlv(), the size of kmalloc is wrongly calculated.
    
    Signed-off-by: Takashi Iwai <[EMAIL PROTECTED]>
    Signed-off-by: Jaroslav Kysela <[EMAIL PROTECTED]>
---
 sound/pci/emu10k1/emufx.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
index c35d9e1..354a892 100644
--- a/sound/pci/emu10k1/emufx.c
+++ b/sound/pci/emu10k1/emufx.c
@@ -665,7 +665,7 @@ static unsigned int *copy_tlv(const unsigned int __user 
*_tlv)
                return NULL;
        if (data[1] >= MAX_TLV_SIZE)
                return NULL;
-       tlv = kmalloc(data[1] * 4 + sizeof(data), GFP_KERNEL);
+       tlv = kmalloc(data[1] + sizeof(data), GFP_KERNEL);
        if (!tlv)
                return NULL;
        memcpy(tlv, data, sizeof(data));
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to