diff options
| author | Takashi Iwai <tiwai@suse.de> | 2008-01-19 10:33:07 +0100 |
|---|---|---|
| committer | Jaroslav Kysela <perex@perex.cz> | 2008-01-31 17:30:05 +0100 |
| commit | 6735e5723b5b4bc9bc0a24a841fbd0f2e7944b3f (patch) | |
| tree | dbc1987bbf2a4c8c19a54532dfc675b86fa1bbc8 /sound/pci/emu10k1/emufx.c | |
| parent | [ALSA] hda-intel - Make azx_get_response() a bit more robust (diff) | |
| download | linux-6735e5723b5b4bc9bc0a24a841fbd0f2e7944b3f.tar.xz linux-6735e5723b5b4bc9bc0a24a841fbd0f2e7944b3f.zip | |
[ALSA] emu10k1 - Fix over-sized kmalloc for TLV
Reported by Al Viro:
In copy_tlv(), the size of kmalloc is wrongly calculated.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Diffstat (limited to 'sound/pci/emu10k1/emufx.c')
| -rw-r--r-- | sound/pci/emu10k1/emufx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c index c35d9e1cb6dd..354a892adb40 100644 --- a/sound/pci/emu10k1/emufx.c +++ b/sound/pci/emu10k1/emufx.c @@ -665,7 +665,7 @@ static unsigned int *copy_tlv(const unsigned int __user *_tlv) return NULL; if (data[1] >= MAX_TLV_SIZE) return NULL; - tlv = kmalloc(data[1] * 4 + sizeof(data), GFP_KERNEL); + tlv = kmalloc(data[1] + sizeof(data), GFP_KERNEL); if (!tlv) return NULL; memcpy(tlv, data, sizeof(data)); |