summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2008-01-19 10:33:07 +0100
committerJaroslav Kysela <perex@perex.cz>2008-01-31 17:30:05 +0100
commit6735e5723b5b4bc9bc0a24a841fbd0f2e7944b3f (patch)
treedbc1987bbf2a4c8c19a54532dfc675b86fa1bbc8
parent28a0d9df0706c523d3bb8de18892c76b78c2e428 (diff)
[ALSA] emu10k1 - Fix over-sized kmalloc for TLV
Reported by Al Viro: In copy_tlv(), the size of kmalloc is wrongly calculated. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
-rw-r--r--sound/pci/emu10k1/emufx.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
index c35d9e1cb6dd..354a892adb40 100644
--- a/sound/pci/emu10k1/emufx.c
+++ b/sound/pci/emu10k1/emufx.c
@@ -665,7 +665,7 @@ static unsigned int *copy_tlv(const unsigned int __user *_tlv)
return NULL;
if (data[1] >= MAX_TLV_SIZE)
return NULL;
- tlv = kmalloc(data[1] * 4 + sizeof(data), GFP_KERNEL);
+ tlv = kmalloc(data[1] + sizeof(data), GFP_KERNEL);
if (!tlv)
return NULL;
memcpy(tlv, data, sizeof(data));