lkml.org 
[lkml]   [2002]   [Aug]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH TRIVIAL]: linux-2.5.31/drivers/telephony/ixj.c
trivial patch to fix the check for following kmalloc size overflow with
elements_used (the type being checked and the type being used were
different, and of different sizes).

--
Silvio
diff -u linux-2.5.31/drivers/telephony/ixj.c dev/linux-2.5.31/drivers/telephony/ixj.c
--- linux-2.5.31/drivers/telephony/ixj.c Sat Aug 10 18:41:18 2002
+++ dev/linux-2.5.31/drivers/telephony/ixj.c Thu Aug 22 10:45:51 2002
@@ -5943,7 +5943,7 @@
lcp = kmalloc(sizeof(IXJ_CADENCE), GFP_KERNEL);
if (lcp == NULL)
return -ENOMEM;
- if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)) || (unsigned)lcp->elements_used >= ~0U/sizeof(IXJ_CADENCE) )
+ if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)) || (unsigned)lcp->elements_used >= ~0U/sizeof(IXJ_CADENCE_ELEMENT) )
{
kfree(lcp);
return -EFAULT;
\
 
 \ /
  Last update: 2005-03-22 13:28    [W:0.032 / U:0.312 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site