Hi,
I noticed a case in sr_ioctl.c's sr_get_mcn where a buffer is allocated, but
the pointer isn't checked for null.
This patch against 2.6.12-rc2 adds a check.
Nate Dailey
Stratus Technologies
Signed-off-by: Nate Dailey <[EMAIL PROTECTED]>
--- linux-2.6.12-rc2/drivers/scsi/sr_ioctl.c.orig 2005-04-20
11:31:27.000000000 -0400
+++ linux-2.6.12-rc2/drivers/scsi/sr_ioctl.c 2005-04-20 11:33:58.000000000
-0400
@@ -281,6 +281,9 @@ int sr_get_mcn(struct cdrom_device_info
char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd));
int result;
+ if (!buffer)
+ return -ENOMEM;
+
memset(&cgc, 0, sizeof(struct packet_command));
cgc.cmd[0] = GPCMD_READ_SUBCHANNEL;
cgc.cmd[2] = 0x40; /* I do want the subchannel info */
-
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
