Skip to contentSkip to conversation

: linux-2.5.31/drivers/telephony/ixj.c

PATCH New Silvio Cesare 1 participant 1 message Aug 22, 2002

lore
Share & tools
lore

Silvio Cesare

author
#0 lore raw

PATCH 1/1 : linux-2.5.31/drivers/telephony/ixj.c

trivial patch to fix the check for following kmalloc size overflow with elements_used (the type being checked and the type being used were different, and of different sizes).

--
Silvio

linux-2.5.31/drivers/telephony/ixj.c renamed from drivers/telephony/ixj.c +1 -1
diff -u linux-2.5.31/drivers/telephony/ixj.c dev/linux-2.5.31/drivers/telephony/ixj.c
@@ -5943,7 +5943,7 @@
 	lcp = kmalloc(sizeof(IXJ_CADENCE), GFP_KERNEL);
 	if (lcp == NULL)
 		return -ENOMEM;
-	if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)) || (unsigned)lcp->elements_used >= ~0U/sizeof(IXJ_CADENCE) )
+	if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)) || (unsigned)lcp->elements_used >= ~0U/sizeof(IXJ_CADENCE_ELEMENT) )
         {
                 kfree(lcp);
                 return -EFAULT;