patch-2.4.5 linux/drivers/telephony/ixj.c

• Lines: 19
• Date: Sat May 19 17:47:55 2001
• Orig file: v2.4.4/linux/drivers/telephony/ixj.c
• Orig date: Fri Mar 2 18:38:39 2001

diff -u --recursive --new-file v2.4.4/linux/drivers/telephony/ixj.c linux/drivers/telephony/ixj.c
@@ -4434,7 +4434,8 @@
 	lcp = kmalloc(sizeof(IXJ_CADENCE), GFP_KERNEL);
 	if (lcp == NULL)
 		return -ENOMEM;
-	if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)))
+	if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)) ||
+	    (unsigned)lcp->elements_used >= ~0U/sizeof(IXJ_CADENCE) )
 	{
 		kfree(lcp);
 		return -EFAULT;
@@ -4475,7 +4476,7 @@
 {
 	IXJ_FILTER_CADENCE *lcp;
 
-	lcp = kmalloc(sizeof(IXJ_CADENCE), GFP_KERNEL);
+	lcp = kmalloc(sizeof(IXJ_FILTER_CADENCE), GFP_KERNEL);
 	if (lcp == NULL)
 		return -ENOMEM;
 	if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_FILTER_CADENCE)))