From 6735e5723b5b4bc9bc0a24a841fbd0f2e7944b3f Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Sat, 19 Jan 2008 10:33:07 +0100 Subject: [ALSA] emu10k1 - Fix over-sized kmalloc for TLV Reported by Al Viro: In copy_tlv(), the size of kmalloc is wrongly calculated. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela --- sound/pci/emu10k1/emufx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sound/pci/emu10k1/emufx.c') diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c index c35d9e1cb6dd..354a892adb40 100644 --- a/sound/pci/emu10k1/emufx.c +++ b/sound/pci/emu10k1/emufx.c @@ -665,7 +665,7 @@ static unsigned int *copy_tlv(const unsigned int __user *_tlv) return NULL; if (data[1] >= MAX_TLV_SIZE) return NULL; - tlv = kmalloc(data[1] * 4 + sizeof(data), GFP_KERNEL); + tlv = kmalloc(data[1] + sizeof(data), GFP_KERNEL); if (!tlv) return NULL; memcpy(tlv, data, sizeof(data)); -- cgit v1.2.3