aboutsummaryrefslogtreecommitdiffstats
path: root/sound/pci
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2008-01-19 04:33:07 -0500
committerJaroslav Kysela <perex@perex.cz>2008-01-31 11:30:05 -0500
commit6735e5723b5b4bc9bc0a24a841fbd0f2e7944b3f (patch)
treedbc1987bbf2a4c8c19a54532dfc675b86fa1bbc8 /sound/pci
parent28a0d9df0706c523d3bb8de18892c76b78c2e428 (diff)
[ALSA] emu10k1 - Fix over-sized kmalloc for TLV
Reported by Al Viro: In copy_tlv(), the size of kmalloc is wrongly calculated. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Diffstat (limited to 'sound/pci')
-rw-r--r--sound/pci/emu10k1/emufx.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
index c35d9e1cb6dd..354a892adb40 100644
--- a/sound/pci/emu10k1/emufx.c
+++ b/sound/pci/emu10k1/emufx.c
@@ -665,7 +665,7 @@ static unsigned int *copy_tlv(const unsigned int __user *_tlv)
665 return NULL; 665 return NULL;
666 if (data[1] >= MAX_TLV_SIZE) 666 if (data[1] >= MAX_TLV_SIZE)
667 return NULL; 667 return NULL;
668 tlv = kmalloc(data[1] * 4 + sizeof(data), GFP_KERNEL); 668 tlv = kmalloc(data[1] + sizeof(data), GFP_KERNEL);
669 if (!tlv) 669 if (!tlv)
670 return NULL; 670 return NULL;
671 memcpy(tlv, data, sizeof(data)); 671 memcpy(tlv, data, sizeof(data));