[PATCH TRIVIAL]: linux-2.5.31/drivers/telephony/ixj.c

[Silvio Cesare]

--J/dobhs11T7y2rNN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

trivial patch to fix the check for following kmalloc size overflow with
elements_used (the type being checked and the type being used were
different, and of different sizes).

--
Silvio

--J/dobhs11T7y2rNN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="patch.2.5.31.ixj"

diff -u linux-2.5.31/drivers/telephony/ixj.c dev/linux-2.5.31/drivers/telephony/ixj.c
--- linux-2.5.31/drivers/telephony/ixj.c	Sat Aug 10 18:41:18 2002
+++ dev/linux-2.5.31/drivers/telephony/ixj.c	Thu Aug 22 10:45:51 2002
@@ -5943,7 +5943,7 @@
 	lcp = kmalloc(sizeof(IXJ_CADENCE), GFP_KERNEL);
 	if (lcp == NULL)
 		return -ENOMEM;
-	if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)) || (unsigned)lcp->elements_used >= ~0U/sizeof(IXJ_CADENCE) )
+	if (copy_from_user(lcp, (char *) cp, sizeof(IXJ_CADENCE)) || (unsigned)lcp->elements_used >= ~0U/sizeof(IXJ_CADENCE_ELEMENT) )
         {
                 kfree(lcp);
                 return -EFAULT;

--J/dobhs11T7y2rNN--