Reported by Al Viro:
In copy_tlv(), the size of kmalloc is wrongly calculated.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
return NULL;
if (data[1] >= MAX_TLV_SIZE)
return NULL;
return NULL;
if (data[1] >= MAX_TLV_SIZE)
return NULL;
- tlv = kmalloc(data[1] * 4 + sizeof(data), GFP_KERNEL);
+ tlv = kmalloc(data[1] + sizeof(data), GFP_KERNEL);
if (!tlv)
return NULL;
memcpy(tlv, data, sizeof(data));
if (!tlv)
return NULL;
memcpy(tlv, data, sizeof(data));