diff options
| author |   H. Peter Anvin <hpa@linux.intel.com> | 2012-01-19 12:56:50 -0800 |
|---|---|---|
| committer | H. Peter Anvin <hpa@linux.intel.com> | 2012-01-19 12:56:50 -0800 |
| commit | 282f445a779ed76fca9884fe377bf56a3088b208 (patch) | |
| tree | d9abcf526baee0100672851e0a8894c19e762a39 /drivers/staging/vt6655/ioctl.c | |
| parent | x86, tsc: Fix SMI induced variation in quick_pit_calibrate() (diff) | |
| parent | uml: fix compile for x86-64 (diff) | |
| download | linux-dev-282f445a779ed76fca9884fe377bf56a3088b208.tar.xz linux-dev-282f445a779ed76fca9884fe377bf56a3088b208.zip | |
Merge remote-tracking branch 'linus/master' into x86/urgent
Diffstat (limited to 'drivers/staging/vt6655/ioctl.c')
| -rw-r--r-- | drivers/staging/vt6655/ioctl.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/staging/vt6655/ioctl.c b/drivers/staging/vt6655/ioctl.c index 432a20993c6e..7fd5cc5a55f6 100644 --- a/drivers/staging/vt6655/ioctl.c +++ b/drivers/staging/vt6655/ioctl.c @@ -300,6 +300,10 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) result = -EFAULT; break; } + if (sList.uItem > (ULONG_MAX - sizeof(SBSSIDList)) / sizeof(SBSSIDItem)) { + result = -EINVAL; + break; + } pList = (PSBSSIDList)kmalloc(sizeof(SBSSIDList) + (sList.uItem * sizeof(SBSSIDItem)), (int)GFP_ATOMIC); if (pList == NULL) { result = -ENOMEM; @@ -571,6 +575,10 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) result = -EFAULT; break; } + if (sNodeList.uItem > (ULONG_MAX - sizeof(SNodeList)) / sizeof(SNodeItem)) { + result = -EINVAL; + break; + } pNodeList = (PSNodeList)kmalloc(sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)), (int)GFP_ATOMIC); if (pNodeList == NULL) { result = -ENOMEM; |