diff --git a/[refs] b/[refs] index a67c85df3ceb..8eef0507e1ac 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: cdbbc618f8f483d72e82af05f2873621cc9c2314 +refs/heads/master: ec7e0aef31e2eece787f7c49df1f031f2a983265 diff --git a/trunk/drivers/staging/tidspbridge/pmgr/dspapi.c b/trunk/drivers/staging/tidspbridge/pmgr/dspapi.c index 9ef1ad9527af..5a18a9417ac2 100644 --- a/trunk/drivers/staging/tidspbridge/pmgr/dspapi.c +++ b/trunk/drivers/staging/tidspbridge/pmgr/dspapi.c @@ -414,10 +414,13 @@ u32 mgrwrap_register_object(union trapped_args *args, void *pr_ctxt) CP_FM_USR(&uuid_obj, args->args_mgr_registerobject.uuid_obj, status, 1); if (status) goto func_end; - /* path_size is increased by 1 to accommodate NULL */ path_size = strlen_user((char *) - args->args_mgr_registerobject.sz_path_name) + - 1; + args->args_mgr_registerobject.sz_path_name); + if (!path_size) { + status = -EINVAL; + goto func_end; + } + psz_path_name = kmalloc(path_size, GFP_KERNEL); if (!psz_path_name) { status = -ENOMEM;