[ALSA] emu10k1 - Fix over-sized kmalloc for TLV
authorTakashi Iwai <tiwai@suse.de>
Sat, 19 Jan 2008 09:33:07 +0000 (10:33 +0100)
committerJaroslav Kysela <perex@perex.cz>
Thu, 31 Jan 2008 16:30:05 +0000 (17:30 +0100)
Reported by Al Viro:
In copy_tlv(), the size of kmalloc is wrongly calculated.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
sound/pci/emu10k1/emufx.c

index c35d9e1cb6dde41b860dc09e694d130da84ed8db..354a892adb40da522ecd30d50473d8863c5eb4ef 100644 (file)
@@ -665,7 +665,7 @@ static unsigned int *copy_tlv(const unsigned int __user *_tlv)
                return NULL;
        if (data[1] >= MAX_TLV_SIZE)
                return NULL;
-       tlv = kmalloc(data[1] * 4 + sizeof(data), GFP_KERNEL);
+       tlv = kmalloc(data[1] + sizeof(data), GFP_KERNEL);
        if (!tlv)
                return NULL;
        memcpy(tlv, data, sizeof(data));