Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6735e572 authored by Takashi Iwai's avatar Takashi Iwai Committed by Jaroslav Kysela
Browse files

[ALSA] emu10k1 - Fix over-sized kmalloc for TLV 



Reported by Al Viro:
In copy_tlv(), the size of kmalloc is wrongly calculated.

Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarJaroslav Kysela <perex@perex.cz>
parent 28a0d9df

sound/pci/emu10k1/emufx.c

+1 −1
Original line number Diff line number Diff line
@@ -665,7 +665,7 @@ static unsigned int *copy_tlv(const unsigned int __user *_tlv) 
		return NULL;

	if (data[1] >= MAX_TLV_SIZE)

		return NULL;

	tlv = kmalloc(data[1] * 4 + sizeof(data), GFP_KERNEL);

	tlv = kmalloc(data[1] + sizeof(data), GFP_KERNEL);

	if (!tlv)

		return NULL;

	memcpy(tlv, data, sizeof(data));