From 984fde47de9487028f068278acc01c40c552e46e Mon Sep 17 00:00:00 2001 From: Kevin McKinney Date: Mon, 26 Sep 2011 22:03:59 -0400 Subject: [PATCH] --- yaml --- r: 268554 b: refs/heads/master c: 0a2cc4977ffd551b58ae20c646bd7083ba5a89d2 h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/drivers/staging/bcm/Bcmchar.c | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/[refs] b/[refs] index 6fdf998a9fcd..597d8ab7a4c0 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: d515d0ff36a7afd528f32e3511780ad8385d957e +refs/heads/master: 0a2cc4977ffd551b58ae20c646bd7083ba5a89d2 diff --git a/trunk/drivers/staging/bcm/Bcmchar.c b/trunk/drivers/staging/bcm/Bcmchar.c index 4c4335383977..867c65c4375d 100644 --- a/trunk/drivers/staging/bcm/Bcmchar.c +++ b/trunk/drivers/staging/bcm/Bcmchar.c @@ -216,7 +216,11 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg) if (copy_from_user(&sRdmBuffer, IoBuffer.InputBuffer, IoBuffer.InputLength)) return -EFAULT; - /* FIXME: need to restrict BuffLen */ + if (IoBuffer.OutputLength > USHRT_MAX || + IoBuffer.OutputLength == 0) { + return -EINVAL; + } + Bufflen = IoBuffer.OutputLength + (4 - IoBuffer.OutputLength%4)%4; temp_buff = kmalloc(Bufflen, GFP_KERNEL); if (!temp_buff)