summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2010-07-22 11:45:23 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2010-07-22 11:45:23 -0700
commit38ea6e62d3e59f7e03c6c96301d1cedaab15ce3f (patch)
tree86bec12c7bb0d6bed4827988eca39e796bb2eae3
parent2851785deb1b9c745a3fabc7e395c966878509b9 (diff)
parent7260042b2d0397e7a8735ca47cd7839a5bb1210b (diff)
Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: talitos - fix bug in sg_copy_end_to_buffer
-rw-r--r--drivers/crypto/talitos.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 637c105f53d2..bd78acf3c365 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1183,10 +1183,14 @@ static size_t sg_copy_end_to_buffer(struct scatterlist *sgl, unsigned int nents,
/* Copy part of this segment */
ignore = skip - offset;
len = miter.length - ignore;
+ if (boffset + len > buflen)
+ len = buflen - boffset;
memcpy(buf + boffset, miter.addr + ignore, len);
} else {
- /* Copy all of this segment */
+ /* Copy all of this segment (up to buflen) */
len = miter.length;
+ if (boffset + len > buflen)
+ len = buflen - boffset;
memcpy(buf + boffset, miter.addr, len);
}
boffset += len;