lkml.org 
[lkml]   [2008]   [Jan]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: something odd in emu10k1/emufx
At Sat, 19 Jan 2008 02:16:14 +0000,
Al Viro wrote:
>
> In copy_tlv() we have
> tlv = kmalloc(data[1] * 4 + sizeof(data), GFP_KERNEL);
> if (!tlv)
> return NULL;
> memcpy(tlv, data, sizeof(data));
> if (copy_from_user(tlv + 2, _tlv + 2, data[1])) {
> kfree(tlv);
> return NULL;
> }
> which looks rather odd, since either we kmalloc too much or copy too little...
> Comments?

It's the former case. The total length should be data[1] +
sizeof(data). I fixed on ALSA tree now.

Thanks,

Takashi


\
 
 \ /
  Last update: 2008-01-19 10:39    [W:0.040 / U:0.040 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site