Messages in this thread Patch in this message |  | | Date | Thu, 22 Aug 2002 10:49:48 -0700 | From | Silvio Cesare <> | Subject | [PATCH TRIVIAL]: linux-2.5.31/drivers/telephony/ixj.c |
| |
trivial patch to fix the check for following kmalloc size overflow with elements_used (the type being checked and the type being used were different, and of different sizes).
-- Silvio diff -u linux-2.5.31/drivers/telephony/ixj.c dev/linux-2.5.31/drivers/telephony/ixj.c --- linux-2.5.31/drivers/telephony/ixj.c Sat Aug 10 18:41:18 2002 +++ dev/linux-2.5.31/drivers/telephony/ixj.c Thu Aug 22 10:45:51 2002 @@ -5943,7 +5943,7 @@ lcp = kmalloc(sizeof(IXJ_CADENCE), GFP_KERNEL); if (lcp == NULL) return -ENOMEM; - if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)) || (unsigned)lcp->elements_used >= ~0U/sizeof(IXJ_CADENCE) ) + if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)) || (unsigned)lcp->elements_used >= ~0U/sizeof(IXJ_CADENCE_ELEMENT) ) { kfree(lcp); return -EFAULT; |  |